Security firm RSA has been the victim of an "extremely sophisticated" attack that has resulted in exfiltration of certain private information, announced Executive Chairman Art Coviello in an open letter published yesterday. The company also filed a note with the SEC, warning of possible risks due to the attack. Since 2006, RSA has been part of EMC.

Some of the information taken relates to the company's SecurID security token hardware and its smartphone-based software equivalent. SecurID tokens are used in two-factor authentication systems; to authenticate, users use both a password and a number generated by the SecurID token. Each token generates a sequence of six-digit pseudo-random numbers, with a new number generated every 60 seconds. The number entered by the user must match the number that the authentication server expects the token to generate, and so allows the server to prove that the user not only knows the password, but also is in possession of the token. Each token has a unique 128-bit seed value to initialize its sequence of numbers. Every user account in the authentication server is associated with the seed of their respective token; this allows the server to know what random numbers to expect.

RSA's announcement was not specific in the information it gave, so exactly what this means for SecurID isn't clear. In the likely worst case, the seed values and their distribution among RSA's 25,000 SecurID-using customers, may have been compromised. This would make it considerably easier for attackers to compromise systems dependent on SecurID: rather than having to acquire a suitable token, they would be required only to eavesdrop on a single authentication attempt (so that they could determine how far through the sequence a particular token was), and from then on would be able to generate numbers at their whim.

This would substantially undermine the security of SecurID installations in customer systems, but would be easy (if a little expensive) to fix: simply re-issue new tokens to everyone.

An even more grave, but a perhaps less likely, outcome is that RSA internally documented some significant weakness in their number generation algorithm—for example, some effective mechanism of reconstructing a token's seed simply by examining a few of the numbers generated. This would give attackers the same ability to generate numbers without possessing tokens—and would also mean that not only was every current token compromised, but also every possible replacement was also compromised. It would necessitate replacement with an entirely new system, with an entirely new generation scheme. Such attacks are already possible, but currently require many hundreds of numbers to be known by the attacker before the seed can be re-created.

More benign outcomes are also possible. The formal algorithm used to generate the numbers might have leaked, for example. Though this algorithm is meant to be secret (so that you have to buy RSA hardware and software if you want to use SecurID), it has already been successfully reverse engineered; disclosure now can't damage the system's security.

The statement from RSA says that the company is confident that the information lost does not enable any "direct attack" on SecurID, which would tend to rule out the possibility of seed reconstruction and similar attacks, but warned that it could be used to "reduce the effectiveness" of the system. The SEC note included a bunch of generic best-practices steps that customers should take to ensure their systems remained secure, but nothing that gave any particular indication of what information was compromised—nor enough for RSA customers to know whether their system security has been materially weakened by the hack.

The attack was described as an Advanced Persistent Threat (APT). This is the same class of attack that was made against Google in Operation Aurora, the Stuxnet attacks on Iran, and more recently against the French Ministry of Finances. The hackers—widely presumed to be working for the Chinese government—use 0-day attacks to get their specific, tailored malware onto the computers of targeted organizations. These programs will generally use rootkit techniques to both persist on infected systems and prevent detection by generic anti-malware software. Once installed, this malware is then usually controlled remotely, enabling it to perform new tasks and spread using new techniques.

Because these attacks are specific to a particular victim or victims, typical anti-malware software won't detect it, and because it tends to spread using 0-day attacks, operating system patching equally provides little defense. Though of no great concern to end-user security, APTs are set to become an ever larger part of the threat landscape for major corporations and governments.