The other morning, out of the blue, a sort of mini DEF CON came to a business breakfast in Sydney, with a public demonstration of how to crack the Australian government’s logons for businesses.
Hardware infosec specialists ICT Security convened a breakfast meeting ostensibly to tell people about Bitcoin. The only clue they had a bigger agenda was buried in the low key byline “How could Bitcoin technology compromise your password database security?”. I confess I missed the sub-plot altogether.
After a wide-ranging introduction to all things Bitcoin – including the theory of money, random numbers, Block Chains, ASICs and libertarianism – an ICT Security architect stepped up to talk about AusKEY, the Australian Government B2G Single Sign On system. And what was the Bitcoin connection? Well it happens that the technology needed for Bicoin mining – namely affordable, high-performance custom chips for number crunching – is exactly what’s needed to mount brute-force attacks on hashed passwords. And so ICT Security went on to demonstrate that the typical AusKEY password can be easily cracked. Moreover, they also showed off security holes in the AusKEY Java code where ‘master’ key details can be found in the clear.
The company says it has brought these vulnerabilities to the government’s attention.
They said that their technique could defeat passwords as long as 10 mixed characters, which exceeds the regular advice for password safe practices.
It’s not entirely clear what ICT Security was seeking to achieve by now demonstrating the attack in public.
White hat exposees are a keen feature of the security ecosystem, and very problematic. In Australia, such exercises are often met with criminal investigation. For example, in 2011 First State Super reported a young man to police after he sent them evidence that he found how the fund’s client logons could be guessed. Early this year, Public Transport Victoria called in the law after a self-professed “security researcher” reported (at first privately) a simple hack to expose travellers’ confidential details. And merely being in possession of evidence of an alleged cyber break-in was enough to get journalist Ben Grubb arrested by Queensland Police in 2011. So alleged hacking can attract zealous policing casting a wide net.
Government security managers will likely be smarting about the adverse AusKEY publicity. Just three months ago the hacker and writer Nik Cubrilovic published a raft of weaknesses in “MyGov”, a Single Sign On for individuals in Australia’s social security system. In classic style, Cubrilovic first raised his findings privately with the Department of Human Services, but when he got no satisfaction, he went public. At this stage, I don’t know if the government has taken the MyGov matter further.
For mine, the main lesson of this morning’s demonstration is that single factor government authentication is obsolete. It is not good enough for citizens to be brought into e-government systems using twenty year old password security. The world is moving on and fast; see the advances being made by the FIDO Alliance to standardise Multi Factor Authentication.
In fact the AusKEY system actually offers an optional hardware USB key, but it hasn’t been popular. That must change. E-government is way too important for single factor authentication. Which is probably the name of ICT Security’s game.