Slashdot Mirror
RSA Admits SecurID Tokens Have Been Compromised
A few months ago, RSA Servers were hacked, and a few weeks ago Duped tokens were used to hack Lockheed-Martin. Well today
Orome1 writes "RSA has finally admitted publicly that the March breach into its systems has resulted in the compromise of their SecurID two-factor authentication tokens. The admission comes in the wake of cyber intrusions into the networks of three US military contractors: Lockheed Martin, L-3 Communications and Northrop Grumman — one of them confirmed by the company, others hinted at by internal warnings and unusual domain name and password reset process."
Sit back peoples, get some popcorn, this should be interesting...
sysadmins and parents of newborns get the same amount of sleep.
1992 called, they wanted the adjective “cyber” back.
Golly Shucks. As it turns out, maintaining a copy of the seed keys for devices we sold specifically as a high-security access control solution on our under-secured network might have been a less than totally good idea... Well, lessons learned, eh?
Didn't Lockheed Martin perform the UK census? I've no idea where there data is held now. I'm sure it's very secure where it is.
Comment removed based on user account deletion
RSA keys are compromised, Sony gets compromised, and meanwhile the bankcard industry continues to come down hard on independent retailers to force them to bring their internal systems into PCI compliance. I know small retailers that have invested tens of thousands to secure their WiFi, update their firewall, upgrade their debit pads, all to protect cardholder data. Seriously, what criminal is going to target Joe's Hardware Store to snag a few hundred bankcards? These guys want the big targets. As Willie Sutton didn't say, "That's where the money is". Criminals are going to aim at the top of the food chain, not at the mom and pop store. And even if they do hack the mom and pop store the damage is minimal compared to an RSA or Sony breach.
"We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
Are there any big, important checkbox-compliant certifications that RSA's customers might have been using the (Not Cheap) RSA tokens to obtain that, as a consequence of this sordid episode, might no longer be attainable with RSA gear? That seems like it would be a fitting punishment for RSA's questionable security practices and even more questionable disclosure practices; but I'm afraid that I haven't wrapped my head around the alphabet soup of compliance acronyms in different areas enough to know.
Am I the only one getting frustrated by all those companies telling everyone that no important/usable data was taken/accessed and comming out a month later with "Sorry, finally they took everything."
Sony, then RSA, even fucking congressmens seem to think lying to everybody is OK.
To hell with the fuking lies.
...is that I'm going to have to fiddle around to get my RSA key fob off my keyring so I can put a new one on. Damn keyrings always end up hurting my nails.
Does this mean someone can hack my WoW account now?????
Here is a link to RSA's official statement made yesterday. They are offering to replace tokens for "customers with concentrated user bases typically focused on protecting intellectual property and corporate networks".
That is corporate VPN, not the people who use tokens issued to get to websites, such as banking info.
Learning HOW to think is more important than learning WHAT to think.
I had assumed that the RSA token I have was just a list of random numbers stored in the keyfob with a matching list stored on a server housed at my employer (unbreakable without server access or physical access to the fob). Apparently, RSA has the servers and everything is calculated (breakable)?
"No additional details about what the RSA attackers did steal that allowed them to misuse the tokens, but it seems likely that both the seeds that link every token to a specific account and the algorithm that calculates the numeric sequence generated by the token have been compromised."
Sony is obvious, but why Verisign?
Wow, SecurID is broken. Maybe now my company will move away from the shitty VPN software they use.
Because they'll sellout to anyone, Government or otherwise.
Nah, how about just offer them a "sorry" and a couple of old games and call it even?
Command attempted to use minibuffer while in minibuffer
It's obvious you're scrambling by frittering away your time on Slashdot.
You're suspect. I think your whole post is a troll.
But wait! They also are now offering to do free security monitoring for your company, to detect intrusions that might happen due to their lack of security.
Oh wait. Never mind.
Our secure tokens are Yubikeys. We use RFID for physical access and the challenge response protocol for authentication.
We didn't like the thought of having to trust a 3rd party with our keys, so we run our own authentication services and use our own "seeds". This way we have one less attack/exploit surface (the MFG) to worry about -- Looks like it paid off for us this time!
Key Lifecycle Management
Re-configuration of YubiKeys by customers
If RSA has your keys... are they really secure?!?!!
we're now scrambling to envisage and generate reports from authentication logs for exceptions that might indicate we're being attacked or have been successfully attacked in the past.
why would you need to scramble? shouldn't you be looking at this anyways? on a regular basis? sure this is a good reason to take a second look - but be scrambling.
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
but be scrambling.
*but *shouldn't* be scrambling
sorry edit ate text
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
All I can find is the usual journalistic garbage, some fear mongering here and there, some harsh comments about RSA, some financial "news" commentary. No real information.
Can anyone on /. with technical knowledge, comment on the hack breaking the entire system (essentially, rooting the auth system) or is it just breaking one of the two factors, that being able to predict the "random" number generation of the keyfobs, so I'm down to merely having a pretty good "one factor"?
Also is the protocol poorly enough designed that the attackers don't need to know anything about the keyfobs, or rephrased, does keeping the serial number info etc about individuals keyfobs secret prevent the break?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
They care more about their reputation than the service they provide. If someone else announces the problem, they are either "speculating" or they have dangerous inside knowledge which would be hard to prove without official acknowledgement from the company. But after so many others came out, it became increasingly difficult to "deny it without denying it" as their corporate lawyers and PR staff usually do. And at just about the same time that congress is beginning to wonder what's going on and call a hearing, they pre-empt by announcing it themselves.
My company's parent company uses these extensively on their gigantic network. When the story first came out about RSA I asked "should we be concerned?" The answer was "No" at the time. Of course, the answer is "yes" now as my company's parent company is one of the world's largest.
RSA betrayed their customers, only admitting to the extent of the hack after it was obvious to all that the tokens were compromised. They're untrustworthy, yet they're in a business where trust is paramount, and I'll be recommending to the company I work for that we don't deal with them again. We are a current customer, and we're now scrambling to envisage and generate reports from authentication logs for exceptions that might indicate we're being attacked or have been successfully attacked in the past.
If they actually cared about providing security to their customers instead of covering their own asses they'd have kept their customers fully informed, but they didn't. If they weren't covering their asses and actually didn't have the logging around their crown jewels to let them know what had happened, well that's even worse.
They're now on my shit list, along with Verisign and Sony, of companies I never want to do business with again.
RSA made their customers aware months ago but they had to sign NDAs. I do agree that they should be on your shit list as they are charging companies to "help" replace all RSA tokens. Smart Cards anyone?
In fairness to RSA, they did release updated best practices to their clients right away and had reason to believe (accurately) that the attackers were interested in the defense industry specifically, so they focused on fixing that first. Really, as long as you lock your system down if someone starts using the wrong RSA token with the wrong username repeatedly, then the chances of an actual penetration are still pretty minimal, at least for any sizable key-space. It's not a situation that would occur in almost any situation in real life, so setting the threshold for lock down to even 2 attempts would be sufficient. Sure it is still much less secure, but with a pool of say 100 users, you are still talking a .01% chance of a breach not being detected and shut down before being effective. That's still a very insignificant, particularly considering it leaves a very characteristic fingerprint of the attack that would make it rapidly obvious if someone was trying it on a large scale and they could take measures accordingly. (Statistically, a broad attack against all RSA clients would likely have a success, but it would still be complex to carry out quickly as usernames and passwords would need to be obtained for the targets as well.)
AJ Henderson
we're now scrambling to envisage and generate reports from authentication logs for exceptions that might indicate we're being attacked or have been successfully attacked in the past.
why would you need to scramble? shouldn't you be looking at this anyways? on a regular basis? sure this is a good reason to take a second look - but be scrambling.
Having been there / done that, what he means is that today, over and above the normal procedure, some PHB around 5 to 10 levels higher in the org chart has mandated that he will call every person who logged in on the telephone and verify that at that time and date it was in fact that person who logged in and not someone else. Or similar level of foolishness.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
After all, at a minimum they had the same access to these networks that the hackers do.
I am very small, utmostly microscopic.
If their tokens could be compromised by this intrusion. Doesn't this in fact mean that their tokens really never was secure? They admit that they have master keys for them, then the question is: Who except RSA Corporate was issued with copies of this? NSA? CIA? Mossad?
This basically means that their product is worse than worthless, and that the company SHOULD NOT be trusted anymore. Full stop.
Comment removed based on user account deletion
If they actually cared about providing security to their customers instead of covering their own asses they'd have kept their customers fully informed, but they didn't.
Have you read their statement? They *still haven't* kept us informed. All they've said is that they'll replace the tokens, and that "the information taken from RSA in March has been used as an element of an attempted broader attack on Lockheed Martin".
Nowhere have they said that the seeds are compromised, nowhere have they told us exactly what information was leaked, only that the leaked information played a role in the LM attack.
The mind boggles.
Check to see if your Company name is available http://bit.ly/m2IHF4
Comment removed based on user account deletion
Their public statement, and their NDA-protected message given directly to clients are two, very different things.
I'm god, but it's a bit of a drag really...
Comment removed based on user account deletion
If you need to keep this machine super-secure and only serving a specific kind of data.....then talk to it via a serial port. No network stacks, no "oh that machine was under-utilized, so we added this function", no nuthin. I hated serial back in the day, but if this shit is going to keep happening, then kill it with fire.
Serves them (rsa's customers) right for not understanding what it is they were buying into...
A system where someone else generates and retains a copy of all the keys, requiring you to have blind faith in that party to keep them secure... Did noone else see the serious flaws in such a system?
In order to build a secure system, look at encryption...
How encryption works is well known, the major algorithms are public knowledge, and are tried and tested. And yet the keys, when used properly are known only to the party who owns them...
You don't run a closed proprietary encryption algorithm, and you don't trust a third party to supply you with crypto keys... That is, unless you're a fool.
If you use such a system, you are placing blind faith in the third party who supplies that system... That party might sell you out to government agencies or for commercial reasons (ie highest bidder), might get hacked, might be infiltrated by a rogue employee, might leave a disk full of data on a train etc...
Because they are an external entity you have no control over them, you probably even gave away your right to sue them when you agreed to the license terms on their software... You are utterly beholden to a company you have no control over, basically they own you, and anyone who owns them also owns you.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
No physical damage was done.
Best Slashdot Co
I actually think they did communicate with the companies. My company uses RSA tokens, and around late March, plans were put in place to replace the SecurID tokens with newer models. Sadly, it was not implemented fast enough, but the Security department were looking to see if something happened. Something did, and access was cut off before the intruders got anywhere.
Point is, the people who needed to know knew about this. Just because it was not public knowledge does not mean it was not disclosed.
that is all fine and sounds good - but i don't consider that scrambling.. i guess to me its just a different meaning.. to me scrambling would be - having to figure out what needs to happen to be able to figure out where you are.
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
If I were in business doing high security work, I would design a secure network that is physically separate from the corporate one and have all jacks on the secure network colored in red with red cables. No software development related to high security work or high security information would be allowed on the corporate network. There would be no permanent connection to the outside world from the secure network. In the event that data does need to be transmitted, I would use a dial-on-demand style connection like PPPoE and wrap the data in sftp or scp encryption keeping the connection open only long enough to transmit, then dropping it. This is really the only way to stymie would be intruders. The connection would not be open long enough to try brute force methods. And, finally, perhaps most importantly, use OpenBSD to secure the network for when the transmission line is opened.
HAHA DISREGARD THAT I SUCK COCKS
Seriously, if you're going to accuse people of trolling because they are pissed at a security company for being hacked and then saying everything was fine until three months later when they finally reveal the scope of their fuckedness, at least log in; anonymous trolling is pointless.
Note, to anyone who responds to this message and points out it's a troll, you're not getting the joke.
Right. Because it's impossible to do anything else while waiting for logs to get processed. Troll indeed.
But you'd think that these companies with several billion-dollar projects could've sprung for tokens from a different vendor? The company I work for is medium-to-large sized (10k employees) and we had been using RSA tokens for our VPN connectivity. When the RSA hack ocurred, our company switched completely to a different vendor within a week without an issue. It's called contingency planning... Not that hard to avoid major security issues... and we don't even need a security clearance to work here.
In fairness to RSA, they did release updated best practices to their clients right away and had reason to believe (accurately) that the attackers were interested in the defense industry specifically, so they focused on fixing that first. Really, as long as you lock your system down if someone starts using the wrong RSA token with the wrong username repeatedly, then the chances of an actual penetration are still pretty minimal, at least for any sizable key-space.
The "updated" best practices is just a rehash of normal best practices. Meanwhile, customers are in the dark as to what exactly is the threat they're dealing with. I suspect you're right in your description of the threat. But the problem is that it remains pure speculation. We just don't know. A security company should not be leaving their customers to speculate and second guess when they do, in fact, have facts available to them. RSA and their customers would be in a much better position if RSA would have simply stated what the compromise was and provided analysis on what they think that means to their customers. RSA's attackers likely already know.
If you are a current customer however, was it you or some other employee who evaluated a system where a third party holds copies of the keys, and deemed such a system fit for use? Surely a system like this, where you are utterly beholden to the supplier would raise a red flag?
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
We are a current customer, and we're now scrambling to envisage and generate reports from authentication logs for exceptions that might indicate we're being attacked or have been successfully attacked in the past.
You don't do this already? You've trusted the entire security of your network to an outside firm? That's probably not a wise decision.
Where I work, all of our RSA key fobs were disabled months ago when RSA first admitted the compromise. Granted, I work at a security company - but Lockheed Martin? Come on...
The updated best practices were released after the attack. Those documents should have been available years ago.
Additionally, following those best practices to the letter functionally make the RSA software an extra shim in an expensive password system. Don't tell me that having my users change their password monthly is anything other than a recipe for a helpdesk nightmare.
Sure. But what should you be looking at? With the volume of data an auth system can generate, you have to pick and choose what data you pay close attention to. It would be rational to say "let's assume the SecureID stuff is working right, and not cross-check it closely except in some automated fashion, and instead spend our time checking this other thing over here."
Then, when your assumption is overtaken by events, you have to do those cross-checks. Assuming you're working efficiently, that means more working hours, or dropping important jobs you were doing before. Sounds like "scrambling" to me.
I see Cryptocard stock going up...
See my subject-line, because my man, it's "ALL ABOUT THE BENJAMINS" & always HAS been... that's why they "kept it on the down low" so-to-speak:
"If they actually cared about providing security to their customers instead of covering their own asses they'd have kept their customers fully informed, but they didn't" - by asifyoucare (302582) on Tuesday June 07, @09:00AM (#36361308)
I think they probably do, as folks like yourself & others ARE part of their income... however, speaking of INCOME?
First & foremost - They're a business, & if they're publicly traded (probably are, but I have not looked to be sure, so... correct me IF I am wrong)?? It's SHARE PRICE they fear falling, hence the "hush hush" about it.
Do I understand that, from THEIR "pov"??? Sure...
(Still, then again, once the truth comes out???? It goes down, anyways... look @ your statements (& I do NOT blame you, not one iota!)).
APK
P.S.=> In the end guys, TRY to look @ it from their "pov" too, but I am FAR MORE WITH YOU AS THE CUSTOMER (because shit like that has happened to us all in some way, shape, or form)...
This is life people, & THIS? This shows you how FRIGGIN' EVIL THE LEGALIZED CRAP TABLE called stockmarkets, really truly are... PLUS - THIS IS WHAT MONEY CAN DO TO PEOPLE... it truly is, the root of all evil!
(Now - I don't think I have to tell anyone here that, because we've ALL had money cause hassles in our personal & business relationships... people get mean, DOWN IN THE DIRT DOG MEAN, when it comes to the "holy dollar/coins/dead-presidents")
... apk
Comment removed based on user account deletion
These things were always insecure from day one. They use an easily reversible algorithm to generate their codes. This seed compromise is just a furthering of the already astounding incompetence that surrounds this product.
Just thinking about this pisses me off. SecurID in its current form does not deserve to exist. Simply rerolling the database and issuing new cards is NOT a valid response.
There is no excuse for token vendors not giving their users the tools to program their own fricking tokens they paid for without absurd greed motivated dependancies on RSA.
Given the expense of SecurID and its intended use in high security environments who the hell wants a threat model that includes a third party company? Why are they even storing this data after giving the customer the required license data for the tokens?
Not a single customer should have had any risk of compromise as a result of RSA being hacked. It is inexecusable. Those effected should demand more from RSA than business as ususal.
Yeah, I agree that they need to be more forthcoming with detailed info. I was just defending that they are not untrustworthy as the previous poster had indicated. Though really, it is well understood how the system works and what information could potentially be compromised on their systems. It sounds like it was pretty much the worst case scenario that could occur (the situation I described is basically the worst possible case). It basically assumes that the token value is known and the only thing not known is the token that goes with a particular user. That said, I do realize now that the situation would actually be worse then though. If you can monitor someone's connection, you could gather their token and then run that timestamp against the known tokens to identify the pairing, granted you need to be able to MIM attack it, but it does raise my risk assessment by multiple orders of magnitude.
AJ Henderson
Like many a company before them, they realized that their name alone was their most important asset. Some senior executive decided to save a few bucks by capitalizing on that name. The shareholders lose out, but the people who made those decisions have long ago collected their bonuses.
Just advertising
Yeah, I agree that they need to be more forthcoming with detailed info. I was just defending that they are not untrustworthy as the previous poster had indicated.
I would argue that not being forthcoming with detailed information concerning the effectiveness of your product(s) has a major impact on how much one can trust a security company.
Though really, it is well understood how the system works and what information could potentially be compromised on their systems.
The devil is in the details. Compromise of seed keys means something very different than compromise of source code for a SecurID authentication appliance (as examples). There is all manner of potential but exactly what happened is important to determine the impact. Speculation is no substitute for facts.
If you can monitor someone's connection, you could gather their token and then run that timestamp against the known tokens to identify the pairing, granted you need to be able to MIM attack it, but it does raise my risk assessment by multiple orders of magnitude.
Agreed - this would mean a significant degradation of the product and expose it to a major attack scenario tokens are supposed to be thwarting (keyloggers). And again... this is why detailed information is important where generic assurances and best practice lists are no substitute.