Exfiltration of Some EMC RSA SecurID Two-factor Authentication Products Related Information
Update to AL11-003
Date: 16 June 2011
Purpose
The purpose of this alert update is to raise awareness of recent changes to the security remediation program for the RSA SecurID tokens.
Assessment
RSA recently confirmed that information taken from the March compromise was used in an attempt to compromise U.S. government military contractor systems. As a result, RSA announced it would expand its security remediation program and offer to replace SecurID tokens where the user base is concentrated and typically focused on protecting intellectual property and corporate networks, and offer to implement risk-based authentication strategies where there is a large dispersed user base, typically focused on protecting web-based financial transactions.
The targeting of military contractor systems and the initial RSA report may indicate a high level of technical resources and specific interests of potential attackers. This pattern is increasingly known in the cyber security community as Advanced Persistent Threat (APT). Historically, other reported targets of APT have included:
- high-profile international events participants
- legal organizations, namely those involved in international contracts, mergers and acquisitions
- organizations involved in international affairs, economics and finance
- security and defense organizations
- natural resources and energy sector organizations
- research and development organizations
- information management / information technology organizations
- political activist groups
A successful attack against RSA SecurID technology would likely require multiple steps. One such step may involve a socially engineered email aimed at obtaining the user's secret PIN code and token serial number. Such emails typically display the following characteristics:
- socially engineered, well crafted, sometimes leveraging social media information
- sender address spoofed to appear to come from trusted internal email address
- source often uses a real webmail account (e.g., gmail, yahoo, msn), sometimes with a name familiar to the recipient (e.g.. yourboss@*web_mail_provider*.com)
- use of embedded link to a web-hosted .zip file containing an executable file
- extensive use of trojanized Adobe and MS files (e.g., Excel, Word) in email attachments
- subject of email, URL and attachment tailored to the user, or use appealing themes
The SANS project found in reference (http://www.sans.edu/student-files/projects/JWP-Binde-McRee-OConnor.pdf) provides a valuable insight on APT behavior. Such behavior includes the use of Remote Access Tools (RAT) such as Poison Ivy.
Suggested Action
CCIRC recommends that organizations using RSA SecurID products for controlling access to high-value information technology assets consider the following actions in light of their business requirements and infrastructure:
- Follow RSA implementation guidelines for enhanced PIN code complexity policy.
- Implement enhanced security measures, such as raising user awareness, to protect token serial numbers and PINs, since those may be vulnerable to social engineering and phishing attacks.
- Evaluate organizational risk in light of available threat, vulnerability, and safeguard information, then implement defence-in-depth principles accordingly.
- Where applicable, contact your RSA account representative(s) for additional mitigation information and consideration for possible replacement of existing tokens with replacements created post–April 2011.
References
Reporting
Critical Infrastructure operators and governments potentially affected by this alert are encouraged to provide an assessment report to the Government Operations Centre.
Number: AL11-003
Date: 17 March 2011
Purpose
The purpose of this alert is to raise awareness of a public report by EMC of a sophisticated cyber attack which may have caused data exfiltration of SecurID related information.
Assessment
On 17 March 2011, RSA, a division of EMC, announced they were a victim of an extremely sophisticated cyber attack which was successful in exfiltrating certain information, some specifically related to RSA' SecurID two-factor authentication products. RSA reports that the information does not enable a successful direct attack on any of their RSA SecurID customers.
RSA's SecurID products include hardware and software tokens used in authentication process, typically between a remote host and a corporate infrastructure. The technology is widely used around the world, by over 30 millions end-users. It can be integrated in multiple computing platforms, including portable devices such as Smartphones.
SecurID is based on the principle of 2-factor authentication. It combines something you have (a token) with something you know (a passcode, or secret PIN). The token uses randomisation algorithms to continuously generate new passwords. This password must be combined with the user secret PIN in order to successfully complete the authentication process. The RSA data exfiltrated could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.
Suggested action
Given the wide usage of SecurID technologies and other RSA products, CCIRC recommends that users of RSA products refer to the corresponding RSA SecurCare Online Note or their account representatives (accordingly) to obtain additional mitigation information and a detailed list of potentially affected products and implementations.
CCIRC will provide additional mitigation advice, accordingly, as it is made available.
References
Reporting
Critical Infrastructure operators and governments potentially affected by this alert are encouraged to provide an assessment report to the Government Operations Centre.
Note to Readers
The Canadian Cyber Incident Response Centre (CCIRC) operates within Public Safety Canada, and works with partners inside and outside Canada to mitigate cyber threats to vital networks outside the federal government. These include systems that keep Canada's critical infrastructure functioning properly, such as the electrical grid and financial networks, or contain valuable commercial information that underpins our economic prosperity. CCIRC supports the owners and operators of systems of national importance, including critical infrastructure, and is responsible for coordinating the national response to any serious cyber security incident.
For general information, please contact Public Safety Canada's Public Affairs division at:
Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@ps-sp.gc.ca