Dear Hadmut Danisch,

2-factor authentication is not a way to protect against malware.

SecurID authentication supports single sign-on technology. As a weak
side of this technology, it means, if single account on any network
host is compromised, this account is compromised in whole network,
because any resource can be accessed from compromised host. An ability
to read current key from device is required to support single sign-on.

The only additional attack factor this issue creates is attacker can
get _physical_ access to console with user's credentials _any time_
while user is logged in, while in case token can not be red (e.g. it's
not plugged to USB) he can only access console short after user logs in
to compromised host (while token is not changed).

--Thursday, September 7, 2006, 10:49:52 PM, you wrote to full-disclosure (at) lists.grok.org (dot) uk [email concealed]:

HD> However, if the Token Code can be read over the USB bus, this
HD> assumption does not hold. A single attack on the PC where the token is
HD> plugged in would compromise both the PIN (e.g. with a keylogger) and
HD> the token itself (e.g. writing a daemon which continuously polls the
HD> token and forwards the token in real time to a remote attacker.

--
~/ZARAZA
http://www.security.nnov.ru/

[ reply ]