Alarm bells are ringing

May 2011 Cyber Security

Two-factor authentication product that manages access at over 30 000 companies is breached.

In March 2011, RSA, the security solutions division of IT giant, EMC, announced that they had been the victim of an advanced persistent threat or APT – a category of cyber crime that is characterised by being sophisticated, organised and determined. Another attribute of an APT is its specific purpose: stealing corporate secrets. In RSA’s case, it was secrets about SecurID, their IT access control product that generates one-time passcodes or OTPs. Users enter their username and ‘normal’ PIN, then add the OTP as an additional step in the IT authentication process.

It now seems that you might also have to say a prayer as part of the process: it is being speculated that the product’s security may have been badly compromised by the cyber villains.

Speaking about the theft, RSA’s executive chairman, Arthur Coviello, said, “APT threats are becoming a significant challenge for all large corporations, and it is a topic I have discussed publicly many times.”

APT: hype or reality?

As one of the world’s largest investment banks, Morgan Stanley obviously holds a lot of sensitive client data. In February 2011, it was reported that the bank’s IT security had been breached – apparently by the same cyber criminals who hit Google at the end of 2009.

The bank has kept quiet about what information may or may not have been stolen, but it seems they have become one of the latest victims of a serial APT attack that security firm McAfee named Operation Aurora.

Other US firms affected by Aurora include Northrop, Grumman, Dow Chemical, Yahoo and Adobe. When Google publicly reported their Aurora breach in Jan 2010, they said their investigations had revealed that at least 20 US companies had been similarly targeted. Some people in the cyber security world say that the number of corporate victims is at least 10 times higher.

While people might debate the risks posed by APTs, the US government takes them seriously. On the same day in January 2010 that Google publicly reported its own breach, Hilary Clinton, US Secretary of State condemned the attack and requested a response from China – Aurora’s alleged source.

APTs: bad for the bottom line

It is unlikely that the financial losses caused by Aurora will ever come to light. Companies are understandably guarded when it comes to reporting that their competitive advantage and future success has been badly undermined by the theft of secrets. So what you do not want is a breach about your breach.

But this is exactly what happened to Morgan Stanley. Their exposure to Aurora emerged as the result of a completely separate breach at the bank’s security consultancy, a company called HBGary that was investigating the Aurora attack.

This breach, via exploited passwords and attributed to the hacktivist group Anonymous, led to a leak of internal HBGary e-mails claiming that Morgan Stanley was hit hard by Aurora and that the bank considered it imperative that details of the intrusion remained secret. Oops ….

Aside from the reputational damage amongst stakeholders, in the case of RSA we are already seeing direct commercial consequences: CA Technologies announced at the end of March that it will offer its ArcotID secure software credentials – for free – in exchange for SecurID tokens.

IT security must end its reliance on cards, PINS and passwords

Just how badly SecurID has been affected remains to be seen, the company is keeping mum about the details. What the theft at RSA does highlight is how attractive IT access credentials are to cyber villains.

If you are in the business of breaking into corporate systems, then stealing passwords and PINs is an obvious place to start. It is well documented that most cyber crimes begin with the theft of these traditional credentials because anyone can use your password, card or PIN. And you can use theirs.

But what makes them attractive is that they allow cyber villains to operate with all the access rights of legitimate users. Intrusion detection systems and solutions aimed at Data Loss Prevention are not much help when the villains appear to be completely legitimate.

What is perhaps surprising is that even the most advanced cyber burglaries begin with credential theft. Heather Adkins, Google’s information security manager, says their exposure to Aurora started with an attempt to discover the passwords of specific employees. Information on these targets was apparently gathered from social media networks and was used to motivate visits to a photo website set up by the people behind Aurora.

One of the Google targets clicked on a link to the site, allowing the villains to establish a connection to their machine. They then used the employee’s stolen credentials to gain access to other Google servers – open sesame for the villains.

Given that fingerprint biometrics have proved so successful in reinforcing physical security within the SA workplace, surely it is time to start including them in IT access control?

For more information contact Supervision Biometric Systems, +27 (0)82 463 3060,

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Next-generation security operations centre
Issue 4 2020, AVeS Cyber Security , Cyber Security
Pay-as-you-use cybersecurity from AveS allows all businesses access to world-class expertise.

Strengthen your passwords for world password day
Issue 4 2020 , Cyber Security
May 7 is World Password Day and KnowBe4 is providing tip sheets, videos and tools to help people strengthen their passwords.

Tips on secure remote working
Issue 3 2020 , IT infrastructure, Cyber Security
NordVPN advises how to stay secure while working from home during the coronavirus outbreak.

The Trojan that’s nearly impossible to remove
Issue 3 2020, Kaspersky , Cyber Security
xHelper – the Trojan that’s nearly impossible to remove – continues to infect thousands of devices. How can you stay safe?

Have your security on lockdown over the lockdown
Issue 3 2020, Vox Telecom , Cyber Security
It’s a given that people working from home have fewer security defences on their home networks than they would have in the office.

Free enterprise-grade security to healthcare organisations
Issue 3 2020 , Cyber Security
Bitdefender offers free enterprise-grade security to all healthcare organisations for up to 12 months.

Someone is out to steal your cookies
Issue 3 2020, Kaspersky , Cyber Security
Kaspersky experts have discovered two new Android malware modifications that, when combined, can allow the thieves to discreetly gain control of the victim’s account.

The political and economic intentions of cybercriminals
Issue 3 2020 , Cyber Security
FortiGuard Labs’ Threat Landscape Report reveals a new perspective on global trade and the allure of election disruption.

FortiGate 1800F next-generation firewall
Issue 3 2020 , Cyber Security
FortiGate 1800F next-generation firewall enables today’s largest enterprises to achieve internal segmentation as well as scale, performance, detection, and enforcement capabilities.

Simple and secure for small businesses
Issue 3 2020 , Cyber Security
New cloud-driven solutions from Cisco make buying, installation and maintenance easy with the Cisco ‘Designed for Business’ portfolio built for simplicity and security.