Comment by wahern
17 days ago
Not to contradict your point, but in 2011 RSA's SecurID backend servers were hacked. TOTPs require shared secrets, and their server had all the secrets to the SecurID keyfobs they managed. Security is hard.
17 days ago
Not to contradict your point, but in 2011 RSA's SecurID backend servers were hacked. TOTPs require shared secrets, and their server had all the secrets to the SecurID keyfobs they managed. Security is hard.
Yep that was a flawed design. Modern ones (ex. Token2 Programmable) are identical but allow burning your own seed, while tampering destroys it.
Was that a nation state-level attack?
RSA and the government were extremely tight lipped about it, including refusing to confirm what data had been exfiltrated. At the time news stories recited that some evidence pointed to the PRC. There may have been some followup after media attention moved on.
I'd be curious if anyone on HN could confirm whether RSA quietly reissued new keyfobs. The safe assumption was the intruders got access to the TOTP secrets, but strictly speaking that was conjecture, unless that was later confirmed directly or indirectly.
This may have been a different incident, but at some point there was chatter about a possible physical intrusion targeting a TOTP backend server for DoD or defense contract systems (Lockheed Martin?).
I think really serious incidents tend to be more vigorously suppressed, unlike humdrum PII exfiltration, for the same reason that during wartime states don't want the enemy to have unequivocal confirmation about how successful an operation was, e.g. whether the secrets exfiltrated included credentials to specific systems.
I briefly tried to keep a list of these types of hardware-based authentication systems hacks. But it's a chore, especially following up.