RSA SecurID曾用名SecurID ，是RSA 安全开发的一种多重要素驗證工具，由安全令牌、鑰匙圈等硬件組成。2011年3月17日，RSA表示他們受到了网络攻击，當時有人向RSA的员工发送了网络钓鱼电子邮件，而电子邮件的附件是一个包含恶意软件的Microsoft Excel文件。当RSA 员工打开 Excel 文件时，黑客就利用了Adobe Flash中的漏洞並通過远程桌面软件控制了RSA网络中的机器並且訪問了服务器， 而且SecurID的数据也遭到泄露。
参考文献
外部鏈接
- [https://www.rsa.com/en-us/products/rsa-securid-suite Official RSA SecurID website]
;Technical details
- [http://seclists.org/bugtraq/2000/Dec/459 Sample SecurID Token Emulator with token Secret Import] I.C.Wiener, Bugtraq post.
- [http://www.homeport.org/~adam/dimacs.html Apparent Weaknesses in the Security Dynamics Client/Server Protocol] Adam Shostack, 1996.
- [https://groups.google.com/group/comp.security.misc/browse_frm/thread/e00fa564dc6aba5a/1f8529e8df4e02dc?tvc=1&hl=en#1f8529e8df4e02dc Usenet thread discussing new SecurID details] Vin McLellan, et al., comp.security.misc.
- [http://tech.groups.yahoo.com/group/securid-users/ Unofficial SecurID information and some reverse-engineering attempts] Yahoo Groups securid-users.
- [https://web.archive.org/web/20110322041959/http://intrepidusgroup.com/insight/2011/03/risk-posed-by-securid-hack/ Analysis of possible risks from 2011 compromise]
;Published attacks against the SecurID hash function
- [http://eprint.iacr.org/2003/162.pdf Cryptanalysis of the Alleged SecurID Hash Function] (PDF) Alex Biryukov, Joseph Lano, and Bart Preneel.
- [http://eprint.iacr.org/2003/205.pdf Improved Cryptanalysis of SecurID] (PDF) Scott Contini and Yiqun Lisa Yin.
- [http://palms.ee.princeton.edu/PALMSopen/contini04fast.pdf Fast Software-Based Attacks on SecurID] (PDF) Scott Contini and Yiqun Lisa Yin.
评论 (0)