RSA Breach: Reactions from the Security Community
Linked by HAL2001 on Sun 20th Mar 2011 08:57 UTC
Privacy, Security, Encryption RSA suffered a breach and data loss following an "extremely sophisticated cyber attack." Their investigation revealed that the information extracted from the company systems is related to its SecurID two-factor authentication products. The news of the incident spread through the community like wildfire and information security professionals are offering their take on this incident. We still don't know the technical details, but it's certain that RSA's brand has taken a big hit.
E-mail Print r 0   16 Comment(s) http://osne.ws/ixs
Thread beginning with comment 467005
To read all comments associated with this story, please click here.
Levelling the playing field
by umccullough on Sun 20th Mar 2011 15:55 UTC
umccullough
Member since:
2006-01-26

Worst case, whatever had been "stolen" from RSA as a result of the breach can't be any worse than if one had used an Open Source solution in the first place.

The "security through obscurity" that RSA has enjoyed could be gone now, but we will never know - unless the contents retrieved during the attack are leaked to the public somehow (hard to imagine).

I don't know much about SecurID (other than the fact that I have a couple of those tokens in my drawer at work for access to customer systems), but I would hope the entire system is open-spec such that it has been audited by the greater security community for potential flaws.

I would imagine that getting your hands on the client/server source code for the SecurID system would be a boon for criminals in order to analyze and discover potential flaws in the software.

Reply Score: 2

Soulbender Member since:
2005-08-18

but I would hope the entire system is open-spec such that it has been audited by the greater security community for potential flaws.


You'd think so and you'd be wrong. It's closed-sauce secret magic all the way. Think of it as a glorified shared secret (ok, it's more complicated). I had to do a little work with SecurID a while back and I found it odd that companies would put so much trust in it.

On related note, I found it funny that someone in the linked articles (can't remebmer who, can't be arsed to check) described SecurID as a pre-determined sequence of random numbers. Uh, hello? It's ethier pre-determined or random, it can't be both. This person should probably stay the f--k away from security.

Edited 2011-03-21 04:44 UTC

Reply Parent Score: 3

Soulbender Member since:
2005-08-18

Worst case, whatever had been "stolen" from RSA as a result of the breach can't be any worse than if one had used an Open Source solution in the first place.


The worst case is that the entire SecurID system is compromised and rendered useless. Much worse than using an OSS solution in the first place, not to mention that it would probably be the end of RSA. Maybe that's why they're trying to tone it down.

Reply Parent Score: 2

umccullough Member since:
2006-01-26

"Worst case, whatever had been "stolen" from RSA as a result of the breach can't be any worse than if one had used an Open Source solution in the first place.


The worst case is that the entire SecurID system is compromised and rendered useless. Much worse than using an OSS solution in the first place, not to mention that it would probably be the end of RSA. Maybe that's why they're trying to tone it down. "

Yeah, that was a poor choice of words on my part ;)

Per your previous reply, that's scary. I would have thought, like RSA encryption itself, that methods used in SecurID was understood by the security community in general.

As for the "pre-determined random number" - I know what they're trying to suggest - but you're right, totally non-random. Sounds like pseudo-random with a specific key on every token, combined with a timestamp to seed with - at least that's my best-guess of the basic premise after seeing how they work.

Reply Parent Score: 2