Vereinfachte Angiffe gegen Hardware-Token

The exploit, described in a paper to be presented at the CRYPTO 2012 conference in August, requires just 13
minutes to extract a secret key from RSA's SecurID 800, which company marketers hold out as a secure way for
employees to store credentials needed to access confidential virtual private networks, corporate domains, and
other sensitive environments. The attack also works against other widely used devices, including the
electronic identification cards the government of Estonia requires all citizens 15 years or older to carry, as
well as tokens made by a variety of other companies.

Automated Bypass of Two-Factor Physical Authentication
All of the instances that involved High Roller malware could bypass complex multi-stage authentication.
Unlike recent attacks that collect simple form authentication data—a security challenge question,
a one-time token, or PIN—this attack can get past the extensive physical (“something you have”)
authentication required by swiping a card in a reader and typing the input into a field (see Two-factor
Authentication sidebar).