RSA hackers exploit Adobe flaw

RSA reveals how its servers were compromised after hackers used spear phishing, an Excel document and an Adobe Flash vulnerability.

The notorious hack which hit RSA last month, when data on one of the security firm's token products was stolen, used a known flaw in Adobe Flash.

Low-level employees were targeted by two different phishing emails over a two-day period, the company revealed on a blog over the weekend.

The messages came attached with an Excel document entitled 2011 Recruitment plan.xls,' and contained a zero-day exploit which took advantage of a now-patched Adobe Flash vulnerability.

The hackers then moved to install a remote administration tool, before gaining access privileges for the targeted SecurID data and files.

The files were stolen and sent to an external machine at a hosting provider.

"In our case the weapon of choice was a Poison Ivy variant set in a reverse-connect mode that makes it more difficult to detect, as the PC reaches out to the command and control rather than the other way around," said Uri Rivner, head of new technologies for consumer identity protection at RSA.

Rivner stressed RSA was quick to detect the Advanced Persistent Threat (APT) something other companies have not been able to do.

"I've been talking to many CISOs in corporations that were hit by similar APTs and a lot of companies either detected the attacks after months, or didn't detect them at all and learned about it from the Government," Rivner said.

"This is not a trivial point: by detecting what is happening early on, RSA was able to respond quickly and engage in immediate countermeasures."

RSA was also keen to defend the way it handled the attack after it hit.

"[RSA] secured their internal systems, and provided customers with specific recommendations designed to ensure their systems were secured as well," said Mischel Kwon, a former president of the United States Computer Emergency Readiness Team (US-CERT), in a blog post on the RSA website.

"Understanding the level of information RSA gave their customers, you understand how RSA deliberately and carefully released the right amount of information to protect the customer, but did not release information that would create unintended risk. This was a difficult balance."

Kwon, who was once vice president of public sector security for RSA, but now owns her own consulting firm, criticised a number of security pros for giving "very uninformed opinions" to the press.

"Understanding who is involved and who is not is critical. RSA was very deliberate and responsible in getting the correct mitigation strategy to those who would need itthe customers," she added.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Adobe rolls out new PayPal payment options through Adobe Commerce
e commerce

Adobe rolls out new PayPal payment options through Adobe Commerce

16 Sep 2021
Signs it’s time to upgrade your CMS
Whitepaper

Signs it’s time to upgrade your CMS

23 Aug 2021
Engaging the new digital workforce blueprint
Whitepaper

Engaging the new digital workforce blueprint

23 Aug 2021
Delivering personalised content for dummies
Whitepaper

Delivering personalised content for dummies

23 Aug 2021

Most Popular

HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021