Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference calls (how quaint!) after they had already happened, so I'm left to wait until tomorrow morning for the next call.

I'm wondering if someone has a recording or transcript of one of the first two calls and/or any additional useful information.

My speculation is that someone downloaded some percentage of seed records for tokens. IIRC, customers (and, apparently, bad guys) can download seed records from the RSA site without a strong second factor. Irony alert!

share|improve this question
2  
I was looking for some more information on how somebody would make the jump from the RSA incident to the Lockheed one. Didn't really see that in the other post. Maybe I missed it. –  getahobby May 29 '11 at 1:31
    
Beginning to look like cloned tokens - but information still sketchy –  Rory Alsop May 29 '11 at 8:12
    
The fact that "SecurID" remains shrouded in security-by-obscurity, and the other question doesn't yet have very authoritative answers, doesn't mean another question will help, in my view. We'll just get more speculation here. When good info comes forth, it should be added to answers on the other question. I suggest merging this with the other one. –  nealmcb May 30 '11 at 1:20

9 Answers 9

up vote 6 down vote accepted

Lots of FUD, but some snippets coming out. Quote from http://www.metafilter.com/101636/RSA-has-been-hacked

One possibility, said Whitfield Diffie, a computer security specialist who was an inventor of cryptographic systems now widely used in electronic commerce, is that a “master key” — a large secret number used as part of the encryption algorithm — might have been stolen.

share|improve this answer
    
Good pointer that I wish I would have thought to check - thanks. RSA isn't exactly helping their own cause re: the FUD. –  Craig H Mar 18 '11 at 20:00
    
The Whitfield Diffie quote appears to have been from this NYTimes story "SecurID Company Suffers a Breach of Data Security" –  blunders Jun 6 '11 at 18:56
    
Another quote... "Asked if the RSA intruders did gain the ability to clone SecurID keyfobs, RSA spokeswoman Helen Stefen said, 'That’s not something we had commented on and probably never will.'" -- From Wired –  blunders Jun 6 '11 at 18:59
    
It is unfortunate that the accepted answer is simply spreading unsubstantiated rumor. –  atk Jun 10 '13 at 12:12

Some good points are made at the Schneier on Security blog: RSA Security, Inc Hacked.

The worry is that source code to the company's SecurID two-factor authentication product was stolen, which would possibly allow hackers to reverse-engineer or otherwise break the system. It's hard to make any assessments about whether this is possible or likely without knowing 1) how SecurID's cryptography works, and 2) exactly what was stolen from the company's servers. We do not know either, and the corporate spin is as short on details as it is long on reassurances.

...

Security is all about trust, and when trust is lost there is no security. User's of SecurID trusted RSA Data Security, Inc. to protect the secrets necessary to secure that system. To the extent they did not, the company has lost its customers' trust.

Updated to fix some misconceptions.... The SecurID access code calculations had already been reverse-engineered - see RSA SecurID data compromised and Cain and Able. The algorithm requires the token-specific AES key ("seed record") supplied by RSA along with the token.

The comments in Schneier's blog speculate on the possible implications. It seems likely that some sort of database of seeds for each serial number has been stolen, allowing attackers who know the serial number (printed on the back of the token) and can figure out the token's clock setting (e.g. by seeing a few access codes) to get the seed and calculate future access codes. If the SecurID is used alone for authentication, that's all they would need. If it is part of a 2-factor system, e.g. used alongside a password or PIN, this would reduce that to a one-factor system.

I'm amazed that SecurID has gotten away so long with so much security thru obscurity in their design! I wonder if they retain the seeds for all the devices they sell - seems like a big risk.

Update: Lockheed was attacked, reportedly via copied SecurID keys: Lockheed Martin Confirms It Came Under Attack – AllThingsD

Update: As @D.W. notes, Dan Kaminsky's Blog On The RSA SecurID Compromise has more complete discussion of the issues here, which generally agrees with the blog comments I noted here, though it doesn't give much weight to Schneier's fears of new attacks based on a hypothesized theft of source code.

share|improve this answer
    
Assuming that the PIN is actually used! Whether or not to enable it is largely configured by the authenticating application and not the AuthManager server. –  Scott Pack Mar 21 '11 at 15:08

News reports are suggesting that the RSA Security breach may have enabled the attackers to clone (duplicate) SecurID tokens used by Lockheed-Martin employees to gain access to the Lockheed-Martin networks. (There are also reports that RSA Security is responding by replacing their customers' SecurID tokens with new ones.)

Unfortunately, it is hard to know at this point what may have happened. RSA Security has been mum about exactly what RSA information or systems the hackers gained access to. The technical specifics make a big difference to assessment of the potential impact of the earlier RSA Security breach. The worst case is that the attackers could have stolen the cryptographic key material present in SecurID tokens, and information about the usernames/accounts of SecurID token holders. This would be very serious, because the key material is the core secret that controls access to networks; an intruder with access to the key material can clone the SecurID token and mount many powerful attacks. There are also many other possibilities that are less serious. For instance, at the other extreme is the possibility that the hackers didn't gain access to any sensitive information at RSA. There are many possibilities in between these two extremes. At this point all we have is speculation.

Part of the what makes it hard to know what's going on is that RSA Security is being closed-mouth about this. That makes it hard to know what the risks may be, which in turn makes it harder for SecurID customers to protect their own systems against those risks. It is tempting to assume the worst, in the lack of information, but it is hard to know whether that is actually justified. (Personal opinion: These incidents raise questions about whether RSA Security has handled this wisely, and whether they've acted in the best interests of their customers. After this incident, I'd expect many security folks will be more reluctant to place their faith and trust in RSA Security in the future.)

share|improve this answer

We've hit the point where some information is starting to trickle out, take this blog post from Uri Rivner. Further summarized by Wanner in this ISC blog post. As detailed by Wanner:

  • The first part of the attack was a spear-phishing attempt aimed at non-high-profile targets. The information on the targets was most likely mined from social networking sites. All it took was one of the targeted employees who was tricked into opening an attached Excel spreadsheet.
  • The Excel spreadsheet contained a zero-day exploit targeting an Adobe Flash vulnerability.
  • The exploit added a backdoor. and installed a remote administration program.
  • The malware then captured credentials for user accounts in order to compromise higher value targets.

It is certainly looking like a reasonably unsophisticated, but targeted attack. They are, of course, throwing around the APT buzzword. While I might disagree with the 'A', the 'PT' certainly seems appropriate.

share|improve this answer
1  
Too bad the info is only about describing the attack, not implications for SecurID customers. Uri has artfully woven together movie themes and descriptions of attacks on other big enterprises to spin this into how RSA will help you get on the cutting edge of a "whole new defense doctrine" which has the amazing property of recognizing that bad guys can get thru the firewall by targeting employees with social engineering! Decades later it continues to surprise me how much people rely on firewalls - crunchy on the outside, chewy on the inside.... –  nealmcb Apr 2 '11 at 14:03
1  
@nealmcb Tell me about it. I skimmed Uri's post, but it was a bit too much like a press release for my likes. –  Scott Pack Apr 2 '11 at 16:28

New information is now coming to light. It looks like the breach at RSA Security may have more severe implications for RSA's customers than RSA previously claimed. Apparently there has been a successful attack on Lockheed Martin's systems, which was made possible by the earlier breach at RSA Security. There are fears that the attackers may have gained access to sensitive weapons-related information, and suggestions that the motivation for the attack on RSA Security may have been to enable these kinds of attacks on military contractors and other customers of RSA Security.

This is beginning to look like a serious black eye for RSA Security. Earlier, RSA Security tried to downplay the implications for their customers of their security failure. Now, it is looking like their earlier claims are not to be trusted. This is a big hit to RSA's credibility. Right now, it looks like people should be awfully wary of relying upon SecurID tokens (and potentially other RSA Security systems) for security. We'll see if additional information surfaces to enable more informed analysis.

share|improve this answer
    
It will be interesting to see what info comes out on this. Two global organisations I have been speaking to are replacing their entire token inventory (many tens of thousands of tokens)! I have no data on whether RSA are charging for this :-) –  Rory Alsop May 28 '11 at 20:35

Back when the incident happened, Professor Steven Bellovin shared some of his thoughts about what could have been stolen and how it might be used, https://www.cs.columbia.edu/~smb/blog/2011-03/2011-03-18.html He posted a follow-up yesterday: https://www.cs.columbia.edu/~smb/blog/2011-05/2011-05-28.html


Edited 07/07/2011:

More details came up today from the company and there's an article over at arstechnica describing what happened to a degree.

It seems that RSA was storing the seed of every single token (..why?) and those got stolen, so all the attacker had to do is sniff/guess/obtain via keyloggers user passwords to get in.

The company said all 40 million rsa tokens are going to be replaced...

share|improve this answer

Here is the best tutorial/introduction to what went wrong that I've seen yet. It has a great deal of technical details about how SecurID worked, why they create a security risk, and the likely implications.

On The RSA SecurID Compromise (Dan Kaminsky's blog)

share|improve this answer

Some more information about the RSA SecurID security breach has become available: in particular, how the attackers got malware onto RSA systems. A new Wired article by Kim Zetter says that the hackers used targeted phishing emails (spear-phishing). It also reveals that the attack was fairly unsophisticated: just a simple email with an Excel attachment that, when opened, exploited a vulnerability in Adobe Flash to compromise the recipient's computer. F-Secure has a blog post with more details.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.