Researchers can defeat RSA SecurID 800 tokens in under 15 minutes

• Researchers were able to use a ‘Padding Oracle Attack’ to compromise the plain text of an imported encrypted key in under 15 minutes
• A ‘Padding Oracle Attack’, is a side channel attack that allows an attacker to see if a message was decrypted successfully or not
• By purposely corrupting the encrypted message and/or its padding in different ways, and watching the error message (or even just the amount of time the device takes to attempt the decryption) the attacker is able to gain more and more information about the encrypted message, until they are able to recover the entire message
• The researchers developed a more efficient version of the ‘million messages attack’, that only requires to be carried out with only a few 10s of thousands of messages, and found that some devices can be attacked with as few as 3800 messages
• Researcher Blog Post
• Research Paper
• Don’t Believe Everything You Read…Your RSA SecurID Token is Not Cracked
• RSA contends that the researchers did not ‘crack’ the RSA SecurID Token, but rather that they exploited a flaw in PKCS#1v1.5
• However the researchers show (Table 1 on Page 9 and Table 3 on Page 12) that because the RSA SecurID tokens use a very simple padding check (not checking the length of the encrypted message), they disclose more information about the encrypted message during each attempt, this results in the RSA SecurID tokens taking the least amount of time to compromise
• The researchers were not able to afford an HSM, but postulate that their attack could compromise even the more secure ones in mere hours

PayPal starts Bug Bounty Program

• Paypal joins the ranks of Google, Mozilla, Facebook, Barracuda and others with bug bountry programs
• This resolves a potential legal ambiguity where researchers that were attempting to forge or modify data being sent to the paypal site, might be accused of unauthorized access rather than legitimate research
• Colin Percivals BSDCan 2012 Presentation – Crowdsourcing Security

FBI run sting operation nets 26 arrests of attempted ‘carders’

• The operation intercepted over 400,000 compromised credit cards
• The FBI estimates it prevented $200 million in losses (likely exaggerated)
• The FBI notified 47 companies, government entities, and educational institutions of the breach of their networks
• Example charges:
• zer0 used hacking tools to steal information from the internal databases of a bank, a hotel, and various online retailers, and then sold the information to others, including an individual he believed to be a fellow carder, but who in fact was an undercover FBI agent
• JoshTheGod (apparently a member of UGNazi) met in Manhattan with an undercover FBI agent to accept delivery of counterfeit cards encoded with stolen information. He was then arrested after attempting to withdraw funds from an ATM using one of the cards
• kool+kake sold stolen CVVs and advertised to fellow carders that he got fresh CVV’s on a daily basis from hacking into databases around the world
  • According to the PCI-DSS (Security standard for processing credit cards, CVVs are NOT allowed to be stored in database, they are specifically designed to make databases of stolen credit cards useless, since the attacker will NOT have the CVV value (which is a 3 or 4 digit numeric hash of the credit card data and the banks secret key)

Botched software update as Royal Bank of Scotland freezes customer accounts for days

• On Monday the 18th, a glitch was introduced into the banking system at RBS, that prevented new deposits from being credited to customers’ accounts
• 2012–06–22 – No solution in sight after four days
• 2012–06–25 – Confidence in the bank starts to slide sharply
• 2012–06–25 – Details start to emerge about the cause of the problem, the batch processing software (run by an outsourced team in India)
• 2012–06–26 – Glitch is identified as a problem with an update to the CA–7 batch processing software
• 2012–06–28 – Confirmation that half the team that runs the CA–7 batch processing software were outsourced to india
• Mishandling of batch schedule data while backing out of an update to CA–7 batch processing software last week caused the disruption that led to 16.9 million customers at RBS, Natwest and Ulsterbank being frozen out of their accounts for days, and ongoing issues in some cases.
• “When they did the back-out, a major error was made. An inexperienced person cleared the whole queue … they erased all the scheduling”

Feedback:

• Q: Alex Asks about: Mirroring Changes Across Hosts
• Q: Lawal asks: How do VPNs Work Exactly?

Round-Up:

• Millions of Website Passwords Stored in Plain Text in Plesk Panel
• Tech Security Savvy Varies with Age (and Experience Counts), Survey Finds
• EU Commissioner Reveals He Will Simply Ignore Any Rejection Of ACTA By European Parliament Next Week
• Australian ISP causes concern while testing Web Filter