Softpedia – (International) RSA SecurID cracked, experts access cryptographic keys in 13 minutes. Researchers released the results of a study which demonstrates that flaws present in many of the popular security devices, such as the RSA’s SecureID 800, can be leveraged to obtain the cryptographic keys. In a paper titled “Efficient padding oracle attacks on cryptographic hardware,” the researchers detail the vulnerabilities that expose the imported keys from various cryptographic devices that rely on the PKCS#11 standard. They describe the method they used, the padding oracle attack, as a “particular type of side channel attack where the attacker is assumed to have access to an oracle which returns true just when a chosen ciphertext corresponds to a correctly padded plaintext under a given scheme.” By creating an optimized version of Bleichenbacher’s attack, the researchers were able to prove that tokens such as the RSA SecurID, the Aladdin eTokenPro, the Gemalto Cyberflex, the - 16 - Safenet Ikey 2032, and the Siemens CardOS can be cracked in a short period of time. The initial variant of the Bleichenbacher attack required millions of decryption attempts, explained a research professor at Johns Hopkins University. However, the new version only requires thousands or tens of thousands of attempts. Tokens that rely on this technology are utilized by numerous organizations to access restricted networks and perform other sensitive operations.
Source: http://news.softpedia.com/news/RSA-s-SecurID-Cracked-Experts-Access-Cryptographic-Keys-in-13-Minutes-277590.shtml
