Alarm bells are ringing

May 2011 Information Security

Two-factor authentication product that manages access at over 30 000 companies is breached.

In March 2011, RSA, the security solutions division of IT giant, EMC, announced that they had been the victim of an advanced persistent threat or APT – a category of cyber crime that is characterised by being sophisticated, organised and determined. Another attribute of an APT is its specific purpose: stealing corporate secrets. In RSA’s case, it was secrets about SecurID, their IT access control product that generates one-time passcodes or OTPs. Users enter their username and ‘normal’ PIN, then add the OTP as an additional step in the IT authentication process.

It now seems that you might also have to say a prayer as part of the process: it is being speculated that the product’s security may have been badly compromised by the cyber villains.

Speaking about the theft, RSA’s executive chairman, Arthur Coviello, said, “APT threats are becoming a significant challenge for all large corporations, and it is a topic I have discussed publicly many times.”

APT: hype or reality?

As one of the world’s largest investment banks, Morgan Stanley obviously holds a lot of sensitive client data. In February 2011, it was reported that the bank’s IT security had been breached – apparently by the same cyber criminals who hit Google at the end of 2009.

The bank has kept quiet about what information may or may not have been stolen, but it seems they have become one of the latest victims of a serial APT attack that security firm McAfee named Operation Aurora.

Other US firms affected by Aurora include Northrop, Grumman, Dow Chemical, Yahoo and Adobe. When Google publicly reported their Aurora breach in Jan 2010, they said their investigations had revealed that at least 20 US companies had been similarly targeted. Some people in the cyber security world say that the number of corporate victims is at least 10 times higher.

While people might debate the risks posed by APTs, the US government takes them seriously. On the same day in January 2010 that Google publicly reported its own breach, Hilary Clinton, US Secretary of State condemned the attack and requested a response from China – Aurora’s alleged source.

APTs: bad for the bottom line

It is unlikely that the financial losses caused by Aurora will ever come to light. Companies are understandably guarded when it comes to reporting that their competitive advantage and future success has been badly undermined by the theft of secrets. So what you do not want is a breach about your breach.

But this is exactly what happened to Morgan Stanley. Their exposure to Aurora emerged as the result of a completely separate breach at the bank’s security consultancy, a company called HBGary that was investigating the Aurora attack.

This breach, via exploited passwords and attributed to the hacktivist group Anonymous, led to a leak of internal HBGary e-mails claiming that Morgan Stanley was hit hard by Aurora and that the bank considered it imperative that details of the intrusion remained secret. Oops ….

Aside from the reputational damage amongst stakeholders, in the case of RSA we are already seeing direct commercial consequences: CA Technologies announced at the end of March that it will offer its ArcotID secure software credentials – for free – in exchange for SecurID tokens.

IT security must end its reliance on cards, PINS and passwords

Just how badly SecurID has been affected remains to be seen, the company is keeping mum about the details. What the theft at RSA does highlight is how attractive IT access credentials are to cyber villains.

If you are in the business of breaking into corporate systems, then stealing passwords and PINs is an obvious place to start. It is well documented that most cyber crimes begin with the theft of these traditional credentials because anyone can use your password, card or PIN. And you can use theirs.

But what makes them attractive is that they allow cyber villains to operate with all the access rights of legitimate users. Intrusion detection systems and solutions aimed at Data Loss Prevention are not much help when the villains appear to be completely legitimate.

What is perhaps surprising is that even the most advanced cyber burglaries begin with credential theft. Heather Adkins, Google’s information security manager, says their exposure to Aurora started with an attempt to discover the passwords of specific employees. Information on these targets was apparently gathered from social media networks and was used to motivate visits to a photo website set up by the people behind Aurora.

One of the Google targets clicked on a link to the site, allowing the villains to establish a connection to their machine. They then used the employee’s stolen credentials to gain access to other Google servers – open sesame for the villains.

Given that fingerprint biometrics have proved so successful in reinforcing physical security within the SA workplace, surely it is time to start including them in IT access control?

For more information contact Supervision Biometric Systems, +27 (0)82 463 3060,

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

New ransomware using BitLocker to encrypt data
Technews Publishing Information Security Residential Estate (Industry)
Kaspersky has identified ransomware attacks using Microsoft’s BitLocker to attempt encryption of corporate files. It can detect specific Windows versions and enable BitLocker according to those versions.

Create order from chaos
Information Security
The task of managing and interpreting vast amounts of data is akin to finding a needle in a haystack. Cyberthreats are growing in complexity and frequency, demanding sophisticated solutions that not only detect, but also prevent, malicious activities effectively.

Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Kaspersky finds 24 vulnerabilities in biometric access systems
Technews Publishing Information Security
Customers urged to update firmware. Kaspersky has identified numerous flaws in the hybrid biometric terminal produced by international manufacturer ZKTeco, allowing a nefarious actor to bypass the verification process and gain unauthorised access.

Responsible AI boosts software security
Information Security
While the prevalence of high-severity security flaws in applications has dropped slightly in recent years, the risks posed by software vulnerabilities remain high, and remediating these vulnerabilities could hinder new application development.

AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

A strong cybersecurity foundation
Milestone Systems Information Security
The data collected by cameras, connected sensors, and video management software can make a VMS an attractive target for malicious actors; therefore, being aware of the risks of an insecure video surveillance system and how to mitigate these are critical skills.