printer friendly version

Alarm bells are ringing

Two-factor authentication product that manages access at over 30 000 companies is breached.

In March 2011, RSA, the security solutions division of IT giant, EMC, announced that they had been the victim of an advanced persistent threat or APT – a category of cyber crime that is characterised by being sophisticated, organised and determined. Another attribute of an APT is its specific purpose: stealing corporate secrets. In RSA’s case, it was secrets about SecurID, their IT access control product that generates one-time passcodes or OTPs. Users enter their username and ‘normal’ PIN, then add the OTP as an additional step in the IT authentication process.

It now seems that you might also have to say a prayer as part of the process: it is being speculated that the product’s security may have been badly compromised by the cyber villains.

Speaking about the theft, RSA’s executive chairman, Arthur Coviello, said, “APT threats are becoming a significant challenge for all large corporations, and it is a topic I have discussed publicly many times.”

APT: hype or reality?

As one of the world’s largest investment banks, Morgan Stanley obviously holds a lot of sensitive client data. In February 2011, it was reported that the bank’s IT security had been breached – apparently by the same cyber criminals who hit Google at the end of 2009.

The bank has kept quiet about what information may or may not have been stolen, but it seems they have become one of the latest victims of a serial APT attack that security firm McAfee named Operation Aurora.

Other US firms affected by Aurora include Northrop, Grumman, Dow Chemical, Yahoo and Adobe. When Google publicly reported their Aurora breach in Jan 2010, they said their investigations had revealed that at least 20 US companies had been similarly targeted. Some people in the cyber security world say that the number of corporate victims is at least 10 times higher.

While people might debate the risks posed by APTs, the US government takes them seriously. On the same day in January 2010 that Google publicly reported its own breach, Hilary Clinton, US Secretary of State condemned the attack and requested a response from China – Aurora’s alleged source.

APTs: bad for the bottom line

It is unlikely that the financial losses caused by Aurora will ever come to light. Companies are understandably guarded when it comes to reporting that their competitive advantage and future success has been badly undermined by the theft of secrets. So what you do not want is a breach about your breach.

But this is exactly what happened to Morgan Stanley. Their exposure to Aurora emerged as the result of a completely separate breach at the bank’s security consultancy, a company called HBGary that was investigating the Aurora attack.

This breach, via exploited passwords and attributed to the hacktivist group Anonymous, led to a leak of internal HBGary e-mails claiming that Morgan Stanley was hit hard by Aurora and that the bank considered it imperative that details of the intrusion remained secret. Oops ….

Aside from the reputational damage amongst stakeholders, in the case of RSA we are already seeing direct commercial consequences: CA Technologies announced at the end of March that it will offer its ArcotID secure software credentials – for free – in exchange for SecurID tokens.

IT security must end its reliance on cards, PINS and passwords

Just how badly SecurID has been affected remains to be seen, the company is keeping mum about the details. What the theft at RSA does highlight is how attractive IT access credentials are to cyber villains.

If you are in the business of breaking into corporate systems, then stealing passwords and PINs is an obvious place to start. It is well documented that most cyber crimes begin with the theft of these traditional credentials because anyone can use your password, card or PIN. And you can use theirs.

But what makes them attractive is that they allow cyber villains to operate with all the access rights of legitimate users. Intrusion detection systems and solutions aimed at Data Loss Prevention are not much help when the villains appear to be completely legitimate.

What is perhaps surprising is that even the most advanced cyber burglaries begin with credential theft. Heather Adkins, Google’s information security manager, says their exposure to Aurora started with an attempt to discover the passwords of specific employees. Information on these targets was apparently gathered from social media networks and was used to motivate visits to a photo website set up by the people behind Aurora.

One of the Google targets clicked on a link to the site, allowing the villains to establish a connection to their machine. They then used the employee’s stolen credentials to gain access to other Google servers – open sesame for the villains.

Given that fingerprint biometrics have proved so successful in reinforcing physical security within the SA workplace, surely it is time to start including them in IT access control?

Share this article:

Further reading: