Slashdot Mirror
Duplicate RSA Keys Enable Lockheed Martin Network Intrusion
An anonymous reader writes "Unknown hackers have broken into the security networks of Lockheed Martin Corp and several other US military contractors, a source with direct knowledge of the attacks told Reuters. They breached security systems designed to keep out intruders by creating duplicates to 'SecurID' electronic keys from EMC Corp's RSA security division, said the person who was not authorized to publicly discuss the matter." There's also coverage at PC Magazine.
â¦said the person who was not authorized to publicly discuss the matter
I love it how these companies and even our own government can't keep people from talking about secrets, like it's so fucking juicy that everyone just has to spill it out to the press.
Yes, I'm not a moron, I know these "not authorized" folks are probably explicitly authorized... It's just the whole security "dance" is so fucking silly.
If you want news from today, you have to come back tomorrow.
All these security breaches reminds me of the game Uplink.
So this is what they hacked RSA for! I was waiting to find out who the end-target was... makes sense.
Bow before me, for I am root.
China, Iran, India, or someone planning to sell it (Russia, Organized Crime, etc...)?
I suppose Israel could do it too. (They'd risk a bit if they got caught, but we know they have the capability.)
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
and we remain confident in the integrity of our robust, multi-layered information systems security
Translation: Our system's breached but maybe you won't realize that if I throw enough buzz words at you...
Can someone explain what was actually stolen from RSA that allowed them to break into the networks? From what I understand even if you had had a duplicate SecurID number generator, you would still need the username and securid password (fixed code + random 6 digit) associated with the account to get into the network. Once you are into the network you probably also need a username (same as above) and user password to access the machines. This sounds more like the attackers must have had significant insider knowledge to get in.
-- How many sigs are as useless as this one?
I think we need new English words to represent these concepts more concisely: an adjective for "not authorized to speak publicly on the matter", and a verb for "confirmed under condition of anonymity".
Wonder what relation, if any, this has to the quantum computer?
Funny may not give karma, but +5 Informative never made anyone snort coffee out their nose.
... Lockheed what the true top speed of the SR-71 was?
Mostly random stuff.
According to PC Magazine: "Classified information is likely out of hackers' hands: Due to the volume of attacks that these kinds of systems on a daily basis, it's highly doubtful that Lockheed—or any security contractor—would keep top-secret information within reach, should one ever breach the remote access gates."
Sounds like wishful thinking to me. Classified information has been breached in the past so why would you expect that it's magically safe now?
If I used a sig over again, would anyone notice?
RSA has kept details of the SecurId attack secret. In particular, they won't even say what was taken.
Of course, the attackers know exactly what was taken, because they are holding and exploiting the material.
So the only people in the dark are the bystanders and-- perhaps most importantly-- potential customers.
Sadly, RSA's secrecy around the incident looks to be a public relations move to conceal the severity of the attack.
These security tokens have always fascinated me. I use Google two-step auth with my phone with the same type of technology. Does anyone know what variables might go in to producing the digits? I imagine possibly the time, MAC address of the phone, and/or some other identifiers.
Dear Reuters:
Expect a visit from some friendly people.
Yours In Krasnoyarsk,
Kilgore T.
there are military or high security environments still using RSA?
All women want is honesty, if you can fake that, you're in.
Looks like Anonymous is planning on building an air force.
I think we need new English words to represent these concepts more concisely: an adjective for "not authorized to speak publicly on the matter", and a verb for "confirmed under condition of anonymity".
verb: confirmedunderconditionofanonymiten adjective: unauthorizedtospeaktothepubliconmatterse
The first one is "unreliable" and the second is "rumoured". As in "an unreliable source is rumoured to have said .... "
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
I they are using soft token apps in addition to hardware keys they are trivial to duplicate if you can get ahold of the key string and password from an employee.
Comment removed based on user account deletion
If you have it, observe 2 or maybe 3 or 4 authentications of a given token, I suspect you can impersonate that token at will.
You will still need the PIN and username and possibly password, but you get those when you snoop the authentications.
And lastly, you'll need a giant bucket of CPU to calculate all the tokens for each point in time you see an RSA key's authentication.
Aren't they the guys who did the UK census? I wonder if they'll offer every UK citizen Identity Protection. Even though I'm from the UK and hence was forced to participate in the census, I'd almost feel good about that information getting stolen, this is what us whiny people were going on about.
I have to agree. Back when I was working at a large computer company doing DoD work, all the stuff classified Secret that was on-line was in a non-networked room. You had to sign in and out. You could not bring any disks/tape/usb drives and the like in there. You had to show your IDs etc. Every Secret item was signed in and out, logged and work-product burned. They were perfectly willing to look at everything you took in or out. The room itself was designed in accordance with tempest procedures to avoid any emissions - so there was definitely no external access. IIRC even the floor was elevated as compared to the other parts of the building, presumably to make sure there was nothing coming in through the floor when needed. And it was all internal walls. I have a hard time believing that any DoD Contractors would be going *backwards* in those respects.
And that was just the *Secret* stuff. The Top Secret was even worse in terms of paper handling, controls, logging, safe access, and paper trails than the merely Secret paper and that continued through the TS vs S world into the computer side. The "burn bag" alone wasn't enough. The security people on both were really on top of making sure that procedures were followed.
Admittedly it has been over 10 years, but I can't believe it would have gone backwards in terms of security. Some things are so basic that it seems unbelievable they'd be changed - but hey, we see it all the time, so who knows.
I didn't know that a 1962 Triumph was faster than the SR-71B
Yes, I'm not a moron
And what exactly is your evidence that you're not a moron?
nothing classified will even be on the compromised networks. classified(US government) material is not placed on networks connected to networks connected to the internet... if so, they have worse problems then bad PR and compromised boxes. you do not want the US government up your ass for spilling classified data.
thought about getting Enterprise protection.
How come I no longer respect big government and corporations to adequately protect themselves and us as a country anymore? It couldn't be because a major security blunder is reported in the press about once a week is it?
How can any large public corporation & defense contractors not have teams of people to constantly audit & oversee security procedures, penetration testing, network analysis, and systems analysis to keep up to date on a daily threat basis?
These constant adverse events inspire dark cynicism in an otherwise positive person.
Logical answers? If you can't keep the bad guys out, for god's sake get them offline permanently.
Martin shouldn't connect to the intr0nets.
TSAgent provocateur thug accessing an NSA fios splitter steal keys
fuck the forth amendment
Healing begins by admitting the sickness
A very convenient comic strip
Open Source Network Inventory for the masses! Kuwaiba
Expect China to develop yet another military technology stolen from the US in the next 24 months, mark my words