News

RSA SecurID Security Tokens Compromised by Hackers

• By William Jackson
• 03/18/2011

An "extremely sophisticated" ongoing attack that appears to have harvested information about the RSA's SecurID two-factor authentication product, often used for bank accounts and network access, was disclosed to the public on Thursday.

"Our investigation has led us to believe that the attack is in the category of an advanced persistent threat," said Art Coviello, executive chairman of RSA, the Security Division of EMC Corp., in an open letter to customers. "While at this time we are confident that that information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of current two-factor authentication implementation as part of a broad attack."

The breach was revealed in the letter and in Securities and Exchange Commission filings, which also included recommendations to customers for mitigating the impact of the breach.

Advanced persistent threats are a broad class of computer attack that typically use sophisticated and often multiple exploits to quietly breach system defenses. The goal of such attacks usually is not to immediately disrupt the system's operations but to remain hidden and quietly gather information for as long as possible without attracting attention, much like a "mole" in traditional espionage.

"APT threats are becoming a significant challenge for all large corporations, and it's a topic I have discussed publicly many times," Coviello wrote in his letter.

Speaking at the RSA Security Conference in San Francisco earlier this year, Coviello described such attacks as part of an evolving threat landscape that has shifted from wholesale crime to targeted attacks that steal high-value information.

"The threat has morphed into one that is much more targeted and sophisticated," he said at the conference. "They are looking for the soft underbelly. People don't realize they are being attacked in this manner."

Such attacks have become high profile since the announcement by Google last year of long-term breaches of its systems in China, and they have become a hot enough topic that they now are referred to simply as APTs. Their emergence is due in part to improved security, Coviello said at the conference. Enterprises are doing a better job of risk assessment and access control.

"We are getting better generally at stopping the broad-based attacks," he said. But criminals and spies — both industrial and national — also are evolving to circumvent these defenses. "I think we keep pace, but there is never a moment to take a deep breath," he said.

Sen. Susan Collins (R-Maine), ranking member of the Senate Homeland Security and Governmental Affairs Committee, used the incident to push for new cybersecurity legislation.

"The cyberattack revealed by RSA today underscores the serious and sophisticated threat we face," she said in a prepared statement. "Congress needs to fundamentally reshape how the federal government works collaboratively with the private sector to address all cyber threats, from espionage and cyber crime to attacks on the most critical infrastructure. The need to pass comprehensive cyber security legislation is more urgent than ever."

Collins, along with senators Joe Lieberman (I-Conn.) and Tom Carper (D-Del.), has introduced the Cybersecurity and Internet Freedom Act (S. 413).

RSA said that it has taken aggressive measures against the threat, including the hardening of its IT infrastructure, and has begun an extensive investigation, working with "the appropriate authorities," of the breach. It also pledged to share, "as appropriate," information about the attacks with the rest of the security community.

The company said it has no evidence that RSA products other than SecurID have been compromised, and that it does not believe any personally identifiable information about individuals has been accessed.

SecurID is a two-factor identity authentication scheme that uses a personal identification number and a token that generates a new one-time password every 60 seconds (in synchronization with the application) to prove the identity of the user accessing a system. In its SEC filings, the company recommended that SecurID customers:

• Increase focus on security for social media applications and the use of those applications and websites by anyone with access to their critical networks.
• Enforce strong password and PIN policies.
• Follow the rule of least privilege when assigning roles and responsibilities to security administrators.
• Re-educate employees on the importance of avoiding suspicious e-mails, and remind them not to provide user names or other credentials to anyone without verifying that person's identity and authority. Employees should not comply with e-mail- or phone-based requests for credentials and should report any such attempts.
• Pay special attention to security around their active directories, making full use of their SIEM products and also implementing two-factor authentication to control access to active directories.
• Watch closely for changes in user privilege levels and access rights using security monitoring technologies such as SIEM, and consider adding more levels of manual approval for those changes.
• Harden, closely monitor, and limit remote and physical access to infrastructure that is hosting critical security software.
• Examine their help desk practices for information leakage that could help an attacker perform a social engineering attack.
• Update their security products and the operating systems hosting them with the latest patches.