A researcher has devised a method that attackers with control
over a victim's computer can use to clone the secret software
token that RSA's SecurID uses to generate one-time passwords.
The technique, described on Thursday by a senior security
analyst at a firm called SensePost, has important implications
for the safekeeping of the tokens. An estimated 40 million
people use various SecurID tokens to access confidential data
belonging to government agencies, military contractors, and
corporations. Scrutiny of the widely used two-factor
authentication system has grown since last year, when RSA
revealed that intruders on its networks stole sensitive SecurID
information that could be used to reduce its security. Defense
contractor Lockheed Martin later confirmed that a separate
attack on its systems was aided by the theft of the RSA data.
Last week's blog post by SensePost's Behrang Fouladi
demonstrated another way determined attackers could in certain
cases circumvent protections built into SecurID. By reverse e