RSA hackers exploit Adobe flaw
RSA reveals how its servers were compromised after hackers used spear phishing, an Excel document and an Adobe Flash vulnerability.
Low-level employees were targeted by two different phishing emails over a two-day period, the company revealed on a blog over the weekend.
The messages came attached with an Excel document entitled 2011 Recruitment plan.xls,' and contained a zero-day exploit which took advantage of a now-patched Adobe Flash vulnerability.
The hackers then moved to install a remote administration tool, before gaining access privileges for the targeted SecurID data and files.
The files were stolen and sent to an external machine at a hosting provider.
"In our case the weapon of choice was a Poison Ivy variant set in a reverse-connect mode that makes it more difficult to detect, as the PC reaches out to the command and control rather than the other way around," said Uri Rivner, head of new technologies for consumer identity protection at RSA.
Rivner stressed RSA was quick to detect the Advanced Persistent Threat (APT) something other companies have not been able to do.
"I've been talking to many CISOs in corporations that were hit by similar APTs and a lot of companies either detected the attacks after months, or didn't detect them at all and learned about it from the Government," Rivner said.
"This is not a trivial point: by detecting what is happening early on, RSA was able to respond quickly and engage in immediate countermeasures."
RSA was also keen to defend the way it handled the attack after it hit.
"[RSA] secured their internal systems, and provided customers with specific recommendations designed to ensure their systems were secured as well," said Mischel Kwon, a former president of the United States Computer Emergency Readiness Team (US-CERT), in a blog post on the RSA website.
"Understanding the level of information RSA gave their customers, you understand how RSA deliberately and carefully released the right amount of information to protect the customer, but did not release information that would create unintended risk. This was a difficult balance."
Kwon, who was once vice president of public sector security for RSA, but now owns her own consulting firm, criticised a number of security pros for giving "very uninformed opinions" to the press.
"Understanding who is involved and who is not is critical. RSA was very deliberate and responsible in getting the correct mitigation strategy to those who would need itthe customers," she added.
The ultimate law enforcement agency guide to going mobile
Best practices for implementing a mobile device programFree download
The business value of Red Hat OpenShift
Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShiftFree download
Managing security and risk across the IT supply chain: A practical approach
Best practices for IT supply chain securityFree download
Digital remote monitoring and dispatch services’ impact on edge computing and data centres
Seven trends redefining remote monitoring and field service dispatch service requirementsFree download