It appears as though the data stolen might include RSA seeds. I thought I'd explain what this means for some of the people here not familiar with SecurID. The

It appears as though the data stolen might include RSA seeds. I thought I'd explain what this means for some of the people here not familiar with SecurID. The seed is used a random key for the token and is used to generate a string of random numbers periodically to use. This is called a one-time pad as you use the numbers in combination with a pass code (PIN) in order to log in. In theory you won't use the same code twice although in practice you can as long as the token number is valid (normally a few seconds). So this provides you with two 'factors' for authentication - something you have (the token number) and something you know (the PIN). If you know the seed for a token you can simulate a token [1](or put it on a real one) and use it. Where the token is being used in conjunction with a PIN (probably the majority of use cases) you'd need to know the PIN. The PIN is between 4 and 8 alphanumeric characters in length, but most people use a 4 digit number (possibly as it's called a PIN and people associated it with bank numbers, I don't know). Now imagine the scenario, you want to break into PG's VPN and he uses SecurID but you have his seed and you've synced up with his token, but you don't know his PIN. You can take a guess that it's a 4 digit PIN (as is common) and that means a maximum of 10,000 authentication attempts. Using a tool like IKECrack[2] you can brute force about 18,000 guesses with a P3-700, so it becomes quite easy to target an organisation that way. Likewise you can start brute forcing two factor auth on Citrix servers as well to great extent. The great thing about all this (from an attacker's perspective) is that people don't change their PINs. Why change one factor when the other is so infallible? But what if you have a more complex PIN? Well, that 62^8 possible combinations for an 8 character alphanumeric PIN. Let's break this down: 62^8 == 2.18340106 × 10^14 combinations 62^8 / 18 000 = 1.21300059 × 10^10 seconds 62^8 / 18 000 / 60 = 202,166,764 minutes 62^8 / 18 000 / 60 / 60 = 3 369 446.07 hours 62^8 / 18 000 / 60 / 60 / 24 = 140,393 machine days That's for a P3-700, modern computers will be considerably more powerful, although at some point the limitations of the machine at the other end kicks in. Bottom line - 4 digit PIN and you're screwed. 8 character alphanumeric PIN and you're probably alright. [1] - http://seclists.org/bugtraq/2000/Dec/459 http://seclists.org/bugtraq/2000/Dec/459 [2] - http://ikecrack.sourceforge.net/ http://ikecrack.sourceforge.net/