Extracting SecurID Token Keys

As far as I can tell, a vulnerability in PKCS#11 has allowed researchers to extract keys from certain RSA SecurID tokens, as well as a host of other secure token type devices. It appears even malware infecting a legit user’s computer can get the keys.

A key-extraction attack like this allows an attacker to access or clone legitimate user credentials… that everyone thought were safe even if the attacker got physical access to them (e.g because the attacker grabbed it from the pants pocket of a sysadmin enjoying adult services).

Stuff like this shows why accountability is key. You have to make sure even legitimate users aren’t committing abuses within the system.

In this case, companies that hadn’t implemented accountability and audit trails now risk getting blindsided by attackers who can perfectly impersonate legitimate users.

The thing is, there are always points in a system that are considered ‘secure enough to forget about’. SecurID tokens for a long time were viewed as solid, thoroughly-proven devices where the odds of a new flaw being found were very slim. So what happens when a flaw is found in a system you’ve figured for years was secure? Unless you’ve got a very crunchy inside as well as a hard outer shell, you’ve got a serious problem.


“Scientists have devised an attack that takes only minutes to steal the sensitive cryptographic keys stored on a raft of hardened security devices that corporations and government organizations use to access networks, encrypt hard drives, and digitally sign e-mails.

The exploit, described in a paper to be presented at the CRYPTO 2012 conference in August, requires just 13 minutes to extract a secret key from RSA’s SecurID 800, which company marketers hold out as a secure way for employees to store credentials needed to access confidential virtual private networks, corporate domains, and other sensitive environments. The attack also works against other widely used devices, including the electronic identification cards the government of Estonia requires all citizens 15 years or older to carry, as well as tokens made by a variety of other companies.[…]

The attack works by repeatedly exploiting a tiny weakness in the wrapper until its contents are converted into plaintext. One version of the attack uses an improved variation of a technique introduced in 1998 that works against keys using the RSA cryptographic algorithm. By subtly modifying the ciphertext thousands of times and putting each one through the import process, an attacker can gradually reveal the underlying plaintext, D. Bleichenbacher, the original scientist behind the exploit, discovered. Because the technique relies on “padding” inside the cryptographic envelope to produce clues about its contents, cryptographers call it a “padding oracle attack.” Such attacks rely on so-called side-channels to see if ciphertext corresponds to a correctly padded plaintext in a targeted system.

It’s this version of the attack the scientists used to extract private keys stored on RSA’s SecurID 800 and many other devices that use PKCS#11, a programming interface included in a wide variety of commercial cryptographic devices. Under the attack Bleichenbacher devised, it took attackers about 215,000 oracle calls on average to pierce a 1024-bit cryptographic wrapper. That required enough overhead to prevent the attack from posing a practical threat against such devices. By modifying the algorithm used in the original attack, the revised method reduced the number of calls to just 9,400, requiring only about 13 minutes of queries, Green said.”


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: