Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?

share|improve this question
up vote 1 down vote accepted

If I understand the question correctly, then I'm guessing the simple answer is No. However, it depends on how, where and when the token is used to authenticate.

No, because once you authenticate (say using SecurID), and you are given some kind of a session identifier, it's the session identifier that matters for subsequent requests, not the initial authentication, which happens only once. Those tools grab those session identifiers, so work independently of any previous authentication. This is one of the fundamental problems with, e.g. Single-Sign-On solutions. They make user and administrators lives easier, but once you are authenticated, it opens up much more opportunity for attackers to abuse.

However, if you implement further authentication checks, don't rely solely on Windows authentication (use web-based authentication for example). Then you can mitigate those attacks to some extent. For example, some banks ask you to re-authenticate before making some transactions. Even if you're already logged in. You can in theory implement similar controls to reduce the effectiveness of those session grabbing attacks.

share|improve this answer
That is kind of what I thought, thanks for your help! – Josh Jan 29 '12 at 5:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.