5

My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN.

I asked our security people (which I respect) and they told me that it was fine. The Two Factor Authentication consists of the "Something you have" the PC itself and the "Something you know" your password to get into the PC and the PIN for the soft token.

It seems to me that having both on the same device effectively comes down to a two part password. You type your username and password (some steps in the middle) and your PIN. Having a single password, even if it is in multiple parts with the RSA software in the middle, is single factor authentication.

In all fairness, the disks are encrypted so bad guys cannot easily break into the system so we are pretty safe but everybody thinks they are safe. That is the idea behind making things difficult for bad guys. What is the point of going through the motions of two factor without implementing it correctly?

I have looked and looked on the web and the only thing I can find is the RSA web site where they say everything is fine with their product which is what I would expect them to say.

I would appreciate some compelling arguments that anybody can make, one way or the other. If you could provide a link to something solid that I can wave in their faces and say "THERE! I told you so!" that would be great. If you have something solid to show me I am barking up the wrong tree, I will be pleased to accept that as well.

I should add that the way the RSA software works is I type in my PIN "12345678" and it responds back with its encoded value "31415926" which changes every minute. If I type anything except for my PIN, it will act exactly the same but the code it gives will not allow authentication. If I have a key logger on my system, it will record the PIN as entered and the bad guys will be able to break into the VPN, provided they have access to my system. If they were to clone my machine and did not apply the work SensePost applied in their test they would be able to access the VPN if they had the PIN. RSA maintains that everything is swell in their response.

The good news is the disks on our machines really are encrypted, I checked. The bad news is we don't have to enter a password to boot so the encryption key is stored on encrypted disk. The Sophos SafeGuard web site says the key "is split into different parts and stored in the ... kernel." This sounds like "security through obscurity" to me. If a determined adversary were to log my keystrokes and steal my machine, they would have access to our VPN.

Improve this question
1
  • Technically yes it satisfies 2-factor authentication. However it is the same as say an SSL client certificate doing mutual SSL authentication to a web login page. Which can be done transparently without the user even knowing.
    – ewanm89
    Dec 29, 2012 at 14:23

1 Answer 1

Reset to default
3

No, it's not fine, obviously. One of the benefits of 2-factor authentication using RSA tokens is the fact that even if the attacker installs a keylogger on the victim's workstation or is able to dump memory of the user's processes, that information will not be sufficient to allow the attacker to authenticate with user's credentials, as a one-time password generated on a different device is required for the authentication to succeed.

If the software tokens are running on the same system, then a simple memory scan will reveal the tokencode and allow the attacker to authenticate on the user's behalf. The attacker can additionally copy the provisioned RSA secret and generate the tokens themselves.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .