RSA acknowledges that the information taken from a hack of its IT system in March had been used to breach computers at defense contractor Lockheed Martin Computers. Hello, I'm Eric Trabaro of Information Security Media Group, and to get a better understanding of the current situation, I'm speaking with Marcus Ranum. He's the chief security officer of Tenable Network Security. Welcome, Marcus.
Thanks for having me. What's your impression of RSA's concession that the hacking march against RSA and its SecurID token helped hackers attack Lockheed Martin computers? I really don't think that anybody knows quite enough from the information that's been disclosed to know exactly what could be going on. There's a number of hypothetical attacks that, you know, some of us have imagined from reading between the lines on the initial release, could be what's going on.
But most of those scenarios involve a fairly complex setup for the attack, so it's interesting to see that this has happened. RSA is offering two things. First, to replace SecurID tokens for customers with concentrated users that typically focus their work on protecting intellectual property and corporate networks. And second, to implement risk-based authentication strategies for consumer-focused customers with a large dispersed user base that typically focus on protecting web-based financial transactions.
I'd like to talk about both of these. First, the offer to replace the SecurID tokens. Would these be secure now or would the same problems that the original breach caused with the original tokens still be in place? Well, they would be okay.
It sounds like, from reading between the lines, that what happened in the first breach is that some of the authentication seeds, the cryptographic seeds for the tokens, got out. So what you would have would be the ID number of the token basically and the cryptographic key. So the problem for an attacker would be to figure out, within a particular organization, who had been issued which token. Because when RSA sells a facility to some customer, RSA doesn't know which token gets allocated to Marcus Ranum or to whoever.
That's our IT people who do that. It sounds like what could be going on here is that an attacker would have to social engineer somehow, would have to social engineer the user to try to find out what their RSA token was. They could look up in the database and produce the same hash sequence using the same cryptographic algorithm. If they issue new tokens that have different keys, that's not going to be in the database that's snuck out, so that's definitely not a problem.
The algorithm here is good. It's as good as the underlying encryption system, which is very good. The problem is that the existing database of keys is out, so any new keys are going to be just fine. Secondly, they were discussing the implementation of a risk-based authentication strategy to protect web-based transactions.
What do you suspect that means? Let me reemphasize, this is a hypothesis that I have. I don't know. I wouldn't be able to talk about it.
It sounds like what they're saying there is in situations where you might be a high-risk customer, you want to make certain that people are extra aware of the danger of having the ID social engineered out of them. Obviously, you want to make certain that your authentication servers are nailed down good and tight and that people are following reasonable practices. That would be a problem, I suppose, for an existing customer that had key fobs all over the place and a customer base that they didn't have good control of. If you couldn't trust your users to not be social engineered, then it would be a good idea to replace the key fob that they've got to one where social engineering couldn't make any difference.
Although, I suppose there's always the potential of social engineering. If you manage to find a particularly stupid user, you could call Bob, the stupid user up, and say, Hey, Bob, could you read me your secure ID number and give me your PIN code? But that's kind of an extra special case of stupid. So if you were a RSA customer, what would you do?
Well, there's a couple possibilities here. Obviously, I would make certain that my staff knew to be careful about the potential for social engineering. That's generally an issue with the attacks on the security industry lately. That's something that people should be being cautious about.
And then the other thing I would do is I suppose I would look at whether or not I had any key fobs that had been used long enough that I thought the batteries might be ready to wear out so I might get a free technology upgrade from RSA out of it. I think what RSA is doing is very good. They're not divulging complete information about what happened, which means that people like me are able to hypothesize what may have gone wrong. We have enough information that we can make an informed decision about the risks involved, but they didn't have to completely dump everything that was going on.
So I think they've handled that very well. Their offer to replace the key fobs for customers I think is pretty cool. It's a pretty smart marketing move on RSA's part. I mean, it gives them a chance to communicate with their customer base.
And I suppose you can make lemonade out of these particular lemons. It gives you an opportunity to talk to your customer point of contact and, hey, do you need any more tokens while you're at it? You know, we'll sell you some more. I don't see this as a huge negative for them because I think that, all things considered, they've handled it fairly well.
And would it serve people well to follow up with what RSA is offering? Yeah, I think that's really a crucial point. Anytime that a vendor tells you, hey, here's a problem with our stuff, you really want to fix it. That's a clue that there's a problem with their stuff and that you really want to fix it.
I actually remember when they had the recall for tires that were exploding on some cars. And I knew people who had those tires until a couple months ago and didn't get the new tires. That's not the right way to do things. I mean, if a vendor, you take the time and expense and the public relations hit to reach out to their customers and say, hey, we have a problem, it's certainly something that you really do need to take seriously.
Their idea of saying you need to be risk-based about it is exactly right. If you're handling huge amounts of money using that token, yeah, sure, it's worth getting a new one. If you're just doing your eBay account, maybe not. It really doesn't matter.
It's just a good idea to take this one seriously. And you have enough confidence in the technology that still is a very good security process. Yeah, the underlying technology is just fine. It sounds like that what happened is kind of everybody's nightmare with any cryptographic product, which is that the individual device keys, it sounds like that's what got out.
The ideal system that does encryption is one that should work if everything about the system is known to the enemy except for the key. The system is perfectly good. This is a case where the keys leaked out. Thank you, Marcus.
Thanks for having me. I've been speaking with Tenable Network Security's Chief Security Officer, Marcus Rammer. For Information Security Media Group, I'm Eric Chabro. Thanks for listening.