A closer look into the RSA SecureID software token
ID: cc40cdba-40dd-5240-afdf-b04f4edad22f
STIX ID: report--cc40cdba-40dd-5240-afdf-b04f4edad22f
Feed Name: SensePost Blog
Threat Score
This report analyzes RSA SecurID Software Token for Windows (v4.10), revealing that device serial numbers can be computed from hostname and user SID, and that the token database (RSASecurIDStorage) protected by DPAPI and machine/user master keys can be exfiltrated and replayed to clone tokens; the author demonstrates cloning across VMs and recommends TPM binding to mitigate the issue.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.