More evidence that Multi-Factor authentication is no Panacea...

I've always been a strong proponent of the judicious use of strong authentication. Due to the government's push to introduce smart cards (known as HSPD-12), and industry standards like PCI, multi-factor authentication is becoming increasingly common for certain system access scenarios across a wide range of organizations. News last week that the Sykipot Trojan has been able to hijack Defense Department smart cards reminds us that these solutions are no silver bullet for security.

"We recently discovered a variant of Sykipot with some new, interesting features that allow it to effectively hijack DoD and Windows smart cards," said Jaime Blasco, a security researcher at AlienVault, in a blog post. "This variant, which appears to have been compiled in March 2011, has been seen in dozens of attack samples from the past year."

Sykipot is commonly used in advanced persistent threat (APT) attacks. According to Blasco, the Sykipot variant recently analyzed by AlienVault contains several commands to capture smart card information and use it to access secure resources.

One of the variant's routines is designed to work with ActivIdentity ActivClient, an authentication software product compliant with DoD's Common Access Card (CAC) specification.

The CAC enables access to DoD computers, networks, and certain facilities. It allows users to encrypt and digitally sign emails and it facilitates the use of public key infrastructure (PKI) for authentication purposes.

This Sykipot variant reads the smart card certificates registered on the victim's computer, steals the card's PIN number using a keylogger module, and uses the information to log into protected resources, as long as the card remains inside the reader, Blasco said. In essence, it becomes a smart card proxy.

There seems to be no end these types of breaches that demonstrate the need for defense-in-depth. I'm predicting that if this trend continues, out-of-band authentication will become increasingly in-vogue...