RSA hackers exploit Adobe flaw
RSA reveals how its servers were compromised after hackers used spear phishing, an Excel document and an Adobe Flash vulnerability.
Low-level employees were targeted by two different phishing emails over a two-day period, the company revealed on a blog over the weekend.
The messages came attached with an Excel document entitled 2011 Recruitment plan.xls,' and contained a zero-day exploit which took advantage of a now-patched Adobe Flash vulnerability.
The hackers then moved to install a remote administration tool, before gaining access privileges for the targeted SecurID data and files.
The files were stolen and sent to an external machine at a hosting provider.
"In our case the weapon of choice was a Poison Ivy variant set in a reverse-connect mode that makes it more difficult to detect, as the PC reaches out to the command and control rather than the other way around," said Uri Rivner, head of new technologies for consumer identity protection at RSA.
Rivner stressed RSA was quick to detect the Advanced Persistent Threat (APT) something other companies have not been able to do.
"I've been talking to many CISOs in corporations that were hit by similar APTs and a lot of companies either detected the attacks after months, or didn't detect them at all and learned about it from the Government," Rivner said.
"This is not a trivial point: by detecting what is happening early on, RSA was able to respond quickly and engage in immediate countermeasures."
RSA was also keen to defend the way it handled the attack after it hit.
"[RSA] secured their internal systems, and provided customers with specific recommendations designed to ensure their systems were secured as well," said Mischel Kwon, a former president of the United States Computer Emergency Readiness Team (US-CERT), in a blog post on the RSA website.
"Understanding the level of information RSA gave their customers, you understand how RSA deliberately and carefully released the right amount of information to protect the customer, but did not release information that would create unintended risk. This was a difficult balance."
Kwon, who was once vice president of public sector security for RSA, but now owns her own consulting firm, criticised a number of security pros for giving "very uninformed opinions" to the press.
"Understanding who is involved and who is not is critical. RSA was very deliberate and responsible in getting the correct mitigation strategy to those who would need itthe customers," she added.
The state of Salesforce: Future of business
Three articles that look forward into the changing state of Salesforce and the future of businessFree Download
The mighty struggle to migrate SAP to the cloud may be over
A simplified and unified approach to delivering Enterprise Transformation in the cloudFree Download
The business value of the transformative mainframe
Modernising on the mainframeFree Download
The Total Economic Impact™ Of IBM FlashSystem
Cost savings and business benefits enabled by FlashSystemFree Download