Hacker News Reader

Comment by lawnchair_larry | Hacker News Reader

The RSA hack was used to clone the Lockheed VPN tokens (which means SecurID was junk crypto to begin with).

http://www.reuters.com/article/2011/05/28/usa-defense-hacker...

So say some data was comprimised such as a way of mapping serial to seeds for tokens. RSA/EMC then told the customers that some of the tokens may have been breached. Wouldn't you expect a "nation's largest military contractor" to attempt to get new tokens/change authorisation procedures? Or maybe they were paying HBGary for security consulting.

It's not that it's "junk crypto" where the crypto part is mathematically sound. It was more to do with information leakage than source of "junk crypto".

OK, it's clearly junk crypto, but do you know enough to explain exactly what went wrong?

I heard something about being able to generate private keys from the serial numbers of the tokens, but even if that's the case, you'd need to know what token/serial number you acutally care about. Not all users are going to have access to anything interesting.

FTA lawnchair_larry linked to:

He said the initial RSA attack was followed by malware and phishing campaigns seeking specific data that would link tokens to end-users, which meant the current attacks may have been carried out by the same hackers.

You also need to get the PIN that the specific user is using in addition to the access code from the token. You can use it without a PIN but that is reducing it to a single factor auth solution.

Reply on news.ycombinator.com