full-disclosure - Re: Re: RSA SecurID SID800 Token vulnerable by design

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 9 Sep 2006 10:12:31 -0400
From: "Brian Eaton" <eaton.lists@...il.com>
To: 3APA3A <3APA3A@...urity.nnov.ru>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: Re: RSA SecurID SID800 Token vulnerable by
	design

On 9/9/06, 3APA3A <3APA3A@...urity.nnov.ru> wrote:
>  The  only  additional  attack factor this issue creates is attacker can
>  get  _physical_  access  to  console with user's credentials _any time_
>  while  user is logged in, while in case token can not be red (e.g. it's
>  not plugged to USB) he can only access console short after user logs in
>  to compromised host (while token is not changed).

For web SSO in particular, accessing the token once is nearly as good
as accessing it constantly.  The token will be used for the initial
authentication, but normally a cookie will be used for session
tracking.  An attacker who can sniff the token code can certainly
steal the cookie as well.

Two-factor auth cannot be said to make accessing the network from a
compromised PC "safe".  That does not make two-factor auth useless.
With plain passwords, once the attacker has the password, they can
access the network at will.  With two-factor auth, they can access the
network for a much more limited time span.

Regards,
Brian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/