SecurID software tokens cloned

Security specialist Behrang Fouladi has managed to clone the software token from RSA's SecurID two-factor authentication system. SecurID serves as an additional layer of security, for example when logging into a company's VPN. It uses secret seed values known only by the two communication partners to create temporary token codes, which users must then enter, in addition to their password, when logging in.

To ensure the security of this process, the token is tied to a particular piece of hardware. However, Fouladi has now managed to use reverse engineering on a Windows software token to eliminate the hardware connection and generate valid token codes using another computer. To this end, he copied the encoded SQLite database, the matching secret keys and other information to the other system, as he describes in more detail in a blog post.

A cloned SecurID token
Source: Behrang Fouladi An attacker who has gained access to a computer using malware, for example, could also have constant access to the SecurID-protected network. RSA spokesman Kevin Kempskie told Ars Technica that the company's security team would "take a closer look" at the report. In the meantime, Fouladi advises against using RSA's software token in risky environments, such as on the laptops of traveling government officials who use SecurID to log into a government networks.

(crve)