Alarm bells are ringing

May 2011 Cyber Security

Two-factor authentication product that manages access at over 30 000 companies is breached.

In March 2011, RSA, the security solutions division of IT giant, EMC, announced that they had been the victim of an advanced persistent threat or APT – a category of cyber crime that is characterised by being sophisticated, organised and determined. Another attribute of an APT is its specific purpose: stealing corporate secrets. In RSA’s case, it was secrets about SecurID, their IT access control product that generates one-time passcodes or OTPs. Users enter their username and ‘normal’ PIN, then add the OTP as an additional step in the IT authentication process.

It now seems that you might also have to say a prayer as part of the process: it is being speculated that the product’s security may have been badly compromised by the cyber villains.

Speaking about the theft, RSA’s executive chairman, Arthur Coviello, said, “APT threats are becoming a significant challenge for all large corporations, and it is a topic I have discussed publicly many times.”

APT: hype or reality?

As one of the world’s largest investment banks, Morgan Stanley obviously holds a lot of sensitive client data. In February 2011, it was reported that the bank’s IT security had been breached – apparently by the same cyber criminals who hit Google at the end of 2009.

The bank has kept quiet about what information may or may not have been stolen, but it seems they have become one of the latest victims of a serial APT attack that security firm McAfee named Operation Aurora.

Other US firms affected by Aurora include Northrop, Grumman, Dow Chemical, Yahoo and Adobe. When Google publicly reported their Aurora breach in Jan 2010, they said their investigations had revealed that at least 20 US companies had been similarly targeted. Some people in the cyber security world say that the number of corporate victims is at least 10 times higher.

While people might debate the risks posed by APTs, the US government takes them seriously. On the same day in January 2010 that Google publicly reported its own breach, Hilary Clinton, US Secretary of State condemned the attack and requested a response from China – Aurora’s alleged source.

APTs: bad for the bottom line

It is unlikely that the financial losses caused by Aurora will ever come to light. Companies are understandably guarded when it comes to reporting that their competitive advantage and future success has been badly undermined by the theft of secrets. So what you do not want is a breach about your breach.

But this is exactly what happened to Morgan Stanley. Their exposure to Aurora emerged as the result of a completely separate breach at the bank’s security consultancy, a company called HBGary that was investigating the Aurora attack.

This breach, via exploited passwords and attributed to the hacktivist group Anonymous, led to a leak of internal HBGary e-mails claiming that Morgan Stanley was hit hard by Aurora and that the bank considered it imperative that details of the intrusion remained secret. Oops ….

Aside from the reputational damage amongst stakeholders, in the case of RSA we are already seeing direct commercial consequences: CA Technologies announced at the end of March that it will offer its ArcotID secure software credentials – for free – in exchange for SecurID tokens.

IT security must end its reliance on cards, PINS and passwords

Just how badly SecurID has been affected remains to be seen, the company is keeping mum about the details. What the theft at RSA does highlight is how attractive IT access credentials are to cyber villains.

If you are in the business of breaking into corporate systems, then stealing passwords and PINs is an obvious place to start. It is well documented that most cyber crimes begin with the theft of these traditional credentials because anyone can use your password, card or PIN. And you can use theirs.

But what makes them attractive is that they allow cyber villains to operate with all the access rights of legitimate users. Intrusion detection systems and solutions aimed at Data Loss Prevention are not much help when the villains appear to be completely legitimate.

What is perhaps surprising is that even the most advanced cyber burglaries begin with credential theft. Heather Adkins, Google’s information security manager, says their exposure to Aurora started with an attempt to discover the passwords of specific employees. Information on these targets was apparently gathered from social media networks and was used to motivate visits to a photo website set up by the people behind Aurora.

One of the Google targets clicked on a link to the site, allowing the villains to establish a connection to their machine. They then used the employee’s stolen credentials to gain access to other Google servers – open sesame for the villains.

Given that fingerprint biometrics have proved so successful in reinforcing physical security within the SA workplace, surely it is time to start including them in IT access control?

For more information contact Supervision Biometric Systems, +27 (0)82 463 3060,

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Managing data privacy concerns when moving to the cloud
Cyber Security
While the cloud offers many business benefits, it can also raise concerns around compliance, and some organisations have taken the approach of staying out of the cloud for this reason.

Accelerating your Zero Trust journey in manufacturing
IT infrastructure Cyber Security Industrial (Industry)
Francois van Hirtum, CTO of Obscure Technologies, advises manufacturers on a strategic approach to safeguarding their businesses against cyber breaches.

The democratisation of threats
Cyber Security
Bugcrowd looks at some of the primary vulnerabilities the world faced in 2021, and the risks moving forward with growing attack surfaces and lucrative returns on crime.

Protecting yourself from DDoS attacks
Cyber Security Security Services & Risk Management
A DDoS attack, when an attacker floods a server or network with Internet traffic to prevent users from accessing connected online services, can be costly in both earnings and reputation.

Exploiting Android accessibility services
Cyber Security
Pradeo Security recently neutralised an application using Android accessibility services that exploits the permission to perform fraudulent banking transactions.

Cyber resilience is more than cybersecurity
Technews Publishing Editor's Choice Cyber Security Integrated Solutions IT infrastructure
Hi-Tech Security Solutions held a round-table discussion focusing on cyber resilience and found that while the resilience discipline includes cybersecurity, it also goes much further.

Keeping devices in check
Cyber Security Asset Management, EAS, RFID IT infrastructure
Kaspersky patents new technology for analysing relationships between electronic devices to counter cyberattacks launched through connected IoT devices.

Considering cloud downtime insurance?
Arcserve Southern Africa Cyber Security IT infrastructure Security Services & Risk Management
Byron Horn-Botha, business unit head, Arcserve Southern Africa, reveals three vital steps that you must consider to ensure business continuity before you buy insurance.

A robust OT cybersecurity strategy
Editor's Choice Cyber Security IT infrastructure Industrial (Industry)
Cyber experts are still struggling to convince senior management to spend money to protect their control system assets, resulting in a lack of even basic measures to protect control systems.

Why Multi-Factor Authentication, universal ZTNA and Zero Trust matter
Access Control & Identity Management Cyber Security
Malicious cyber actors are experimenting with new attack vectors and increasing the frequency of zero-day and other attacks, according to Fortinet’s 1H 2022 FortiGuard Labs Threat Landscape report.