IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

RSA hackers exploit Adobe flaw

RSA reveals how its servers were compromised after hackers used spear phishing, an Excel document and an Adobe Flash vulnerability.

The notorious hack which hit RSA last month, when data on one of the security firm's token products was stolen, used a known flaw in Adobe Flash.

Low-level employees were targeted by two different phishing emails over a two-day period, the company revealed on a blog over the weekend.

The messages came attached with an Excel document entitled 2011 Recruitment plan.xls,' and contained a zero-day exploit which took advantage of a now-patched Adobe Flash vulnerability.

The hackers then moved to install a remote administration tool, before gaining access privileges for the targeted SecurID data and files.

The files were stolen and sent to an external machine at a hosting provider.

"In our case the weapon of choice was a Poison Ivy variant set in a reverse-connect mode that makes it more difficult to detect, as the PC reaches out to the command and control rather than the other way around," said Uri Rivner, head of new technologies for consumer identity protection at RSA.

Rivner stressed RSA was quick to detect the Advanced Persistent Threat (APT) something other companies have not been able to do.

"I've been talking to many CISOs in corporations that were hit by similar APTs and a lot of companies either detected the attacks after months, or didn't detect them at all and learned about it from the Government," Rivner said.

"This is not a trivial point: by detecting what is happening early on, RSA was able to respond quickly and engage in immediate countermeasures."

RSA was also keen to defend the way it handled the attack after it hit.

"[RSA] secured their internal systems, and provided customers with specific recommendations designed to ensure their systems were secured as well," said Mischel Kwon, a former president of the United States Computer Emergency Readiness Team (US-CERT), in a blog post on the RSA website.

"Understanding the level of information RSA gave their customers, you understand how RSA deliberately and carefully released the right amount of information to protect the customer, but did not release information that would create unintended risk. This was a difficult balance."

Kwon, who was once vice president of public sector security for RSA, but now owns her own consulting firm, criticised a number of security pros for giving "very uninformed opinions" to the press.

"Understanding who is involved and who is not is critical. RSA was very deliberate and responsible in getting the correct mitigation strategy to those who would need itthe customers," she added.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Adobe forced to patch its own failed security update
bugs

Adobe forced to patch its own failed security update

18 Feb 2022
Adobe rolls out new PayPal payment options through Adobe Commerce
e commerce

Adobe rolls out new PayPal payment options through Adobe Commerce

16 Sep 2021
Signs it’s time to upgrade your CMS
Whitepaper

Signs it’s time to upgrade your CMS

23 Aug 2021
Engaging the new digital workforce blueprint
Whitepaper

Engaging the new digital workforce blueprint

23 Aug 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Samsung proposes 11 Texas semiconductor plants worth $191 billion
Hardware

Samsung proposes 11 Texas semiconductor plants worth $191 billion

21 Jul 2022
Should you take your password manager off the internet?
Sponsored

Should you take your password manager off the internet?

28 Jul 2022