March 3, 2015

Another NSA backdoor found in RSA’s products

rsa-squareAccording to research performed by a group of professors from Johns Hopkins, the University of Wisconsin and the University of Illinois, the security company RSA used a second security tool developed by the NSA which reduced the time needed to crack secure Internet communications.

At the end of last year is was revealed that the NSA paid RSA $10 million to use the Dual Elliptic Curve random number generator in its products. It has since come to light that the Dual Elliptic Curve algorithm had a built-in flaw which made it easier for the NSA to decrypt data that was encrypted with a random number generated by the Dual Elliptic Curve generator.

According to research seen by Reuters, the team of academic researchers have discovered that a second NSA tool, known as the “Extended Random” extension for secure websites, could reduce the time needed to crack a version of RSA’s Dual Elliptic Curve software by tens of thousands of times.

The company is reported to have told Reuters that it had not intentionally weakened security on any product and noted that Extended Random was not widely adopted. RSA also said that the Extended Random functionality has been removed from its software.

“We could have been more skeptical of NSA’s intentions,” said RSA Chief Technologist Sam Curry. “We trusted them because they are charged with security for the U.S. government and U.S. critical infrastructure.”

The researchers were able to demonstrate the weakness of the Dual Elliptic Curve random number generator by decrypting TLS connections made using the RSA Share library in several seconds.

Following the release of documents by former NSA contractor Edward Snowden, a presidential advisory group reported that the NSA’s practice of subverting cryptography standards should stop.

The possibility of a back door in the Dual Elliptic Curve random number generator was first mooted back in 2007. Recent research shows that when the NSA’s default parameters are replaced with new values, the current popular cryptography libraries are still vulnerable. According to the report’s authors, “The RSA BSAFE implementations of TLS make the Dual EC back door particularly easy to exploit compared to the other libraries we analyzed. ”

The research concludes that the Extended Random extension allows a client to request longer TLS random numbers from the server, a feature that, if it enabled, would speed up the Dual EC attack by a factor of up to 65,000.

In brief: RSA launches new system which splits credentials over two servers

(LiveHacking.Com) – RSA has launched a new distribution system which splits credentials over two servers. The idea being that if one server is hacked the attackers only gains access to half of the stored information (password etc). The system called “RSA Distributed Credential Protection” scrambles, randomizes and splits passwords into multiple locations.

As part of the system, administrators can re-randomize and re-split log-in data if a breach is suspected. This means that unless the hackers manage to break into both servers before the re-hashing, the stolen data would be useless.

“DCP scrambles, randomizes and splits sensitive credentials, passwords and Pins and the answers to life or challenge questions into two locations,” said the RSA’s mananger Liz Robinson.

The product however isn’t open source but is rather a commercial offering. RSA expect that DCP will be ready before the end of the year. It will cost about $150,000 per licence which RSA says is less than the cost of “an expensive lawsuit.”

Worldwide losses from phishing attacks increases to over US$687 million

(LiveHacking.Com) – RSA has released some new figures about phishing attacks during the first half of 2012 and the news isn’t good. The number of phishing attacks rose again (for the fourth time), this time by 19% compared to the second half of 2011. In real terms this means that the estimated worldwide financial losses from these attacks alone amounted to over US$687 million.

The countries targeted by the attacks has remained unchanged with the top five being the UK, U.S., Canada, Brazil and South Africa. Although Canada occupies a spot in the top three, it has also seen some significant increases with phishing attacks increasing by nearly 400% in the first half of 2012. This is likely due to the economic health of the North American country, to put it simply fraudsters follow the money.

“The interesting part this time was the fact that the industry’s attack duration median (uptime), according to the Anti-Phishing Working Group, went down from 15.3 hours per attack to 11.72 hours per attack, thus somewhat curbing the monetary impact of each attack, even though attack numbers keep climbing,” wrote Limor Kessem. “Had attack medians remained the same, the monetary losses to phishing in 1H2012 would have exceeded US$897 million. Statistically speaking, this saved the world close to an additional 31% in money that could have been lost to phishing attackers.”

Phishing is, of course a crime, and it is perpetrated by fraudsters who can persuade victims to respond to a legitimate-looking email or click on a seemingly safe link. To do that, the attackers create emails to play on human emotions, it is a con. Although phishing is a modern crime for the Internet age, the forces behind it – manipulation, deceit and persuasion – are not.

With Internet users increasingly relying on webmail and social networking sites, successful phishing attacks to obtain access to Facebook or Gmail open the doors to many other avenues. If an email account is hacked by information used during a phishing attack then the attacker can reset passwords for other important accounts (PayPal, Amazon, Apple/iCloud etc). This is what happened to Mat Honan. The hackers managed to breached Mat’s iCloud account and then proceeded to reset all of Mat’s accounts and devices, they even sent remote wipe commands to Mat’s iPhone, iPad and MacBook.

RSA SecurID Software Token Cloned and Rendered Useless

(LiveHacking.Com) – The use of two-factor authentication has grown as the simple username & password method has proved to be insufficient for more sensitive systems. From online banking to employee access to business networks two-factor authentication is become more the norm, even Google optionally offers two step authentication to its service like Gmail. In two-factor authentication a token is needed which can only be generated by something in possession of the user. In the past this has been a special hardware device which churns out the right numbers during login. However the widespread use of smart phones allows these devices to be used as an authentication token generator. For example, RSA SecureID software token programs are available for iPhone, Nokia and the Windows platforms.

Security researcher Behrang Fouladi has posted details of how he has been able to clone the software token from RSA’s SecurID two-factor authentication system on the Windows platform. On the Windows platform the SecurID software token program uses a hard drive plug-in with unique device serial number. If the same user tries to install the software on a different computer, the user cannot import software tokens into the application because the hard drive plug-in on the second computer has a different serial number. This means that only one user on one computer can be authorized to generate the tokens.

Fouladi has managed to reverse engineer the hard disk plugin and discover that the serial number is formed from the system’s host name and current user’s windows security identifier (SID). An attacker, with access to these values, can easily calculate the target token’s device serial number and bypass the plug-in which ties the software to just one machine.  The SecureID device serial number calculation can be represented with the following formula: device_serial_number=Left(SHA1(host_name+user_SID+“RSA Copyright 2008”),10)

Fouladi’s how-to goes on to explain how the token information, including the secret seed value, is stored in a SQLite database and the steps needed to decrypt the information in that database. “When the above has been performed, you should have successfully cloned the victim’s software token and if they run the SecurID software token program on your computer, it will generate the exact same random numbers that are displayed on the victim’s token,” he wrote.

Behrang has proved his technique by installing two instances of the software  (A and B) on two separate Windows XP virtual machines and attempted to clone token B on the virtual machine that was running token A. Using his method, token B was successfully cloned on the machine running token A.

Is SSL Falling Apart? New Research Papers Find More Holes

(LiveHacking.Com) – Two new research papers (here and here) have been published which examine the low level details of SSL, specifically randomness aspects, and the results are surprising. According to the “Ron was wrong, Whit is right” paper,  two out of every one thousand RSA moduli that on the Internet today offer no security. While the Princeton’s Center for Information Technology Policy blog shows that 0.4% of all the public keys used for SSL web site security can be remotely compromised.

Two in one thousand is  0.2%, Princeton is talking 0.4%. These aren’t huge numbers… but a search on Google for how many sites have “https://” in the URL shows 19,640,000,000 sites. Some of these are sites about HTTPS and aren’t secure sites. If just one quarter of those are really using https, that is 4,910,000,000 sites. 0.4% of 1,964,000,000. That is a lot of SSL certificates. And a huge potential number of sites which can be hacked.

“Our conclusion is that the validity of the assumption is questionable and that generating keys in the real world for “multiple-secrets” cryptosystems such as RSA is signi cantly riskier than for “single-secret” ones such as ElGamal or (EC)DSA which are based on Die-Hellman,” wrote Arjen K. Lenstra et al.

SSL has been having a hard time recently and it is starting to look as if this system isn’t as robust as previously thought. Recent SSL stories include the BEAST, Diginotar and Verisign.

“Unfortunately, we’ve found vulnerable devices from nearly every major manufacturer and we suspect that more than 200,000 devices, representing 4.1% of the SSL keys in our dataset, were generated with poor entropy. Any weak keys found to be generated by a device suggests that the entire class of devices may be vulnerable upon further analysis,” wrote Nadia Heninger.

20 Percent of Fortune 100 Companies Were Hit by the RSA Attackers

(LiveHacking.Com) – Brian Krebs, who was until just a couple of years ago a reported for The Washington Post, has revealed that over 760 other companies have been hit by the same attackers which targeted RSA earlier this year.

In his blog post, Brian says that “more than 760 other organizations had networks that were compromised with some of the same resources used to hit RSA. Almost 20 percent of the current Fortune 100 companies are on this list.”

Brian does, however, give some caveats:

  1. Many of the network owners listed are Internet service providers, and are likely included because some of their subscribers were hit.
  2. It is not clear how many systems in each of these companies or networks were compromised.
  3. Some of these organizations (there are several antivirus firms mentioned  below) may be represented because they  intentionally compromised internal systems in an effort to reverse engineer malware used in these attacks.
The most interesting name on the list include:
  • The Alabama Supercomputer Network
  • Cisco Systems
  • eBay
  • The European Space Agency
  • Facebook,
  • Google
  • IBM
  • Intel Corp
  • the Internal Revenue Service (IRS)
  • MIT
  • Motorola Inc.
  • Northrop Grumman
  • Novell
  • PriceWaterhouseCoopers
  • Research in Motion (RIM) Ltd.
  • Seagate Technology
  • VMWare

RSA to Replace SecurID Tokens – But Not For Everyone

Back in March, RSA revealed that its systems had come under a “very sophisticated cyber attack” and that as a results “certain information” related to its SecurID product was taken. Then last week Lockheed Martin, the US defense contractor and manufacturer of a variety of military products including the Trident missile and F-16, disclosed that its IT systems had come under “a significant and tenacious attack.” What connects these two events? Lockheed Martin uses SecurID.

In the post about the Lockheed Martin attack I wrote that “RSA need to be more public about how they are dealing with the theft of the information relating to SecurID. If this attack is a direct result of that theft, then no user of SecurID is safe. Have RSA been replacing the SecurID tokens and changing the keys and seeds?”

RSA have finally spoken up and have confirmed that the information taken from RSA in March was used during the attack on Lockheed Martin. As a result RSA will expand its “security remediation program to reinforce customers’ trust in SecurID tokens” and it will offer to replace SecurID tokens.

But - and the fact that there is a but is a very bad  for of RSA - only for “customers with concentrated user bases typically focused on protecting intellectual property and corporate networks.”

I have read that phrase “customers with concentrated user bases typically focused on protecting intellectual property and corporate networks” a dozen times and to be honest I have no idea what it means practically. It is probably a polite way of saying, “if you are a big customer we will give you new SecurID tokens, if you aren’t, forget it.”

The result is that Lockheed Martin will get new SecurID tokens as will any other defense contractor or big corporate. The rest of its customers get nothing, but then RSA don’t think you have anything worth stealing.

Lockheed Martin Thwarts IT Breach

Lockheed Martin, the US defense contractor and manufacturer of a variety of military products including the Trident missile and F-16, has acknowledged that its IT systems came under “a significant and tenacious attack” last week, but that due to the fast work of its security team it was able to protect all systems and data.

According to the press release, “as a result of the swift and deliberate actions taken to protect the network and increase IT security, our systems remain secure; no customer, program or employee personal data has been compromised.”

However what the Lockheed Martin press release fails to mention is that the company uses SecureID tokens from RSA to provide two-factor authentication for remote VPN access to their corporate networks.

Two months ago RSA revealed in an open letter to its customers that its servers where compromised by an extremely sophisticated cyber attack and as a result “certain” information was extracted from RSA’s systems.

That “certain” information turns out to be information about RSA’s SecurID two-factor authentication products, which has now been used to reduce the effectiveness of a SecurID.

Lockheed Martin are to be congratulated on their speed and efficiency in dealing with this attack. However this attack marks a significant turning point in the nature and makeup of cyber attacks. First, RSA need to be more public about how they are dealing with the theft of the information relating to SecureID. If this attack is a direct result of that theft, then no user of SecurID is safe. Have RSA been replacing the SecurID tokens and changing the keys and seeds? Second, the nature of this attack, in that is was planned and premeditated, starting with an attack on RSA and then an attack on Lockheed Martin is a significant and disturbing event.

Zero Day Exploit in Flash was Used to Crack Open RSA’s Servers

Two weeks ago RSA revealed in an open letter to its customers that its servers where compromised by, what they called, “an extremely sophisticated cyber attack”. As a result information relating to RSA’s SecurID two-factor authentication products was extracted from RSA’s systems.

Now, Avivah Litan, an analyst at Gartner Research, has revealed that the hackers used the recently revealed zero day exploit in Adobe’s Flash.

The hackers started their attack by sending phishing emails to groups of RSA employees. The emails were cheekily titled “2011 Recruitment Plan”. Attached to the email was an Excel spreadsheet with the recently-discovered Adobe Flash zero day flaw CVE-2011-0609. In turn this allowed them to download trojans onto RSA’s system where they started hacking until they finally gained privileged access.

Litan does praise RSA’s openness about the attack, but there are questions about RSA’s internal security especially since they sell a fraud detection systems based on user and account profiling that should spot abnormal behavior and intervene in real time.

RSA’s Servers Hacked – Reduces Effectiveness of SecurID

RSA has revealed in an open letter to its customers that its servers where compromised last week by an extremely sophisticated cyber attack and as a result certain information was extracted from RSA’s systems.

RSA go on to say that some of the stolen information relates to RSA’s SecurID two-factor authentication products which could potentially be used to reduce the effectiveness of a SecurID.

RSA’s SecurID two-factor authentication mechanism consists of a “token” (either hardware or software) that generates an authentication code at fixed intervals (usually 30 or 60 seconds) using a built-in clock and the card’s unique factory-encoded seed. To authenticate a user needs to enter a PIN and the number generate by the token.

Although unclear, it is supposed that the hackers have managed to get hold of a list of the seeds assigned to various tokens.

SecurityWeek got in contact with Kenneth Weiss, the original inventor of the SecurID: “The SecurID technology I designed and patented has never been breached in 25 years of use. This unfortunate breach of security at RSA speaks to the quality of their internal security not the security of the SecurID token. The possession of 40,000,000 random SecurID seeds is meaningless unless a subset can be associated with a particular one of 30,000 worldwide clients and then intern directly associated with a particular client user. Even if such identification were possible, an attacker would also have to know the particular user’s PIN. This information is not stored on RSA computers.”