IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  IBM Verify Security

    Posted Sun July 07, 2019 03:12 AM
    Hello all,

    We received a question from a client that how secure is IBM Verify? The IBM Verify stores some information regarding the user for generating the TOTP, for example shared secret. So, how likely is it that any malware or other app attempts and successfully gets access to this information for a user and manages to steal it, then starts generating TOTP? Could it be possible?

    Best regards,

    ------------------------------
    Jahanzaib Sarwar
    ------------------------------


  • 2.  RE: IBM Verify Security

    Posted Mon July 08, 2019 03:01 AM
    Edited by Carsten Hagemann Mon July 08, 2019 04:03 AM
    Hi Jahanzaib,

    IBM Verify is designed and implemented up to the security standards by today. On a 'common' device, other apps don't have access to IBM Verify data.

    For Android, all sensitive data (OTP secrets, tokens) is encrypted with AES-256 and stored in a database. The key itself is protected by the Android Keystore.

    For iOS, all data is stored in applicationDataDirectory and protected by disk encryption.

    There are attacks described against the Android Keystore (https://eprint.iacr.org/eprint-bin/getfile.pl?entry=2016/677&version=20160706:055348&file=677.pdf) and the hardware responsible for disk encryption (Extracting Qualcomm's KeyMaster Keys - Breaking Android Full Disk Encryption) and others. As those attacks targeting the underlying OS, IBM Verify could be vulnerable to those attacks as well.

    So, is it possible to steal a secret? Probably. Is it likely? I think it is highly unlikely. Those attacks are not easy to carry out or require physical access to the device. Furthermore, I haven't seen them targeting newer version of Android.

    As rooted devices are more vulnerable to malicious apps: IBM Verify submits a deviceRooted (bool) attribute during registration and token refresh. This can be taken into account on server side to flag that device/user accordingly.

    ------------------------------
    Carsten Hagemann
    ------------------------------

    Original Message


  • 3.  RE: IBM Verify Security

    Posted Wed July 10, 2019 10:52 AM
    Edited by Jahanzaib Sarwar Wed July 10, 2019 10:56 AM
    Hi Carsten,

    Thank you very much for the detailed answer. I got the understanding and we can explain the same to the customer. Also, as per your explanation of the deviceRooted attribute, we can check if we could use this attribute in an access control policy to try to block such devices from registering, also flag the device as an other approach.

    Thanks and best regards,

    ------------------------------
    Jahanzaib Sarwar
    ------------------------------

    Original Message


Related Content