3 ms·

RSA SecurID attack details unveiled – they should have known better

23 points by trotsky 16y ago

kqueue 16y ago
>The irony is that they don’t eat their own dogfood. In other words, they relied on yesterday’s best of breed tools to prevent and detect the attack. I don't think she understands what eating your dogfood means.
- alecco 16y ago
  In the following paragraph she mentions RSA didn't use another tool they sell to prevent this kind of attacks. I think she used the phrase correctly. http://en.wikipedia.org/wiki/Eating_your_own_dog_food http://en.wikipedia.org/wiki/Eating_your_own_dog_food
  - kqueue 16y ago
    Can you copy that specific section?
    - Groxx 16y ago
      >RSA sells its own fraud detection systems based on user and account profiling ... They should have applied these techniques to their own internal systems. As they were using a network observer which wasn't as sophisticated as other tools they make and sell.
    - alecco 16y ago
      I don't know why you ask, it's right next paragraph to your quote. But let's save other people the time to check: > The irony though with RSA is that they don’t eat their own dog food. > In other words, they relied on yesterday’s best of breed tools to > prevent and detect the attack. They gave a lot of credit to NetWitness > for helping them find the attack in real time but they obviously weren’t > able to stop the attack in real time, which means the signals and > scores weren’t high enough to cause a person to shut down the attack > in real time. > > RSA sells its own fraud detection systems based on user and account > profiling which use statistical Beysian models, and rules, to > spot abnormal behavior and intervene in real time to re-authenticate > users and verify the authenticity of suspect access, behavior, or > transactions. (RSA appears in the leaders quadrant of Gartner’s 2010 > Web Fraud Detection Magic Quadrant). They should have applied these > techniques to their own internal systems. They need to stay innovative > and apply the lessons learned from serving their clients to their own > internal enterprise systems.
chair6 16y ago
I was really hoping it would be something at least somewhat interesting like an SQL injection vulnerability or some kind of 0-day (EDIT: in external facing system/service), for the sake of RSA. But no, it was email attachments (EDIT: granted, with an Excel 0-day). Email attachments???!! Says a lot about the effectiveness of security awareness training. Fear the APT.
- blantonl 16y ago
  It was a zero day vulnerability in Excel that caused the isse - those tend to easily have great impact.
- trotsky 16y ago
  If it's as they describe they did have a 0-day used on them. The email attachments, which were excel spreadsheets with an embedded flash exploit apparently were the source of the 0-day report documented in CVE-2011-0609 and published on Mar 14. The RSA attack was reported on Mar 17. https://www.adobe.com/support/security/advisories/apsa11-01.html https://www.adobe.com/support/security/advisories/apsa11-01.... While there is definitely something to be said for what you're saying about "omg, email attack" the other side of the coin is that spearphishing is the most popular/common attack vector because it works.
  - chair6 16y ago
    I was thinking 'in external facing system/service' while I was typing 0-day but yes, you're right. Agreed on the spearphishing point.
  - mryall 16y ago
    It's a good reminder that with ubiquity comes an increased focus on security. I'm much more conscious of the security problems with Flash after a lot of recent news about it. However, it isn't necessarily because it's any less secure than other applications, just that it's ubiquitous and therefore a more likely avenue of attack.
- jws 16y ago
  It came through an Excel document, but it appears to be an Adobe Flash security flaw, CVE 20110609
Pahalial 16y ago
I can't believe the person who wrote this is legitimately knowledgeable about this industry or the relevant tech. Phonetically misspelling "Bayesian" as "Beysian", while hardly a deal-breaker or even worth notice from someone non-technical, is a giant red flag from someone trying to sell themselves as a technically competent analyst.
trotsky 16y ago
RSA has posted a more detailed account to their blog: Anatomy of an Attack http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/
- mukyu 16y ago
  Sadly, it provides basically no details. Skip to the appendix if you don't want to read irrelevant comparisons to U-Boats and stealth aircraft. Even there, the details are light. They got spearphished with excel files with flash payloads (CVE-2011-0609). Those installed "Poison Ivy" (some remote admin a la vnc/rdp). They spread out from those points attacking other accounts/computers/servers. They looked around for interesting things, put it in passworded RARs and FTPed them out to other compromised (non-RSA) servers (apparently "Good[DOT]mincesur[DOT]com | up82673[DOT]hopto[DOT]org | www[DOT]cz88[DOT]net"). There is very little useful information in their breakdown. Everything they mention is standard fair, certainly not something special to "Advanced Persistent Threats". The flash vuln (with excel files) has been known for weeks. There is no discussion of what the attackers actually managed to get their hands on.
  - trotsky 16y ago
    Agreed that all of the "omg, APT" in there comes off pretty badly in light of the reported details. APT has more or less been poisoned as a term lately (see comodo, etc.) and amounts to the latest scapegoat scenario. "See, we can't be blamed! It's an APT!" is what I'm betting the RSA board hopes is the take away here. Of course they could also know something pretty significant that they're not telling. What was taken and how tough it was to get at internally could be a flag. If there was a really significant or telling element to the attack it may well be that they've been asked not to reveal it. Not that I'd bet on that side of the line.
Estragon 16y ago
So, does everyone still think it's China? Have they been able to trace the IP addresses back, at all?
- trotsky 16y ago
  There is a US-CERT EWIN that makes it seem like either it was, or someone wanted people to think it was. Which does of course not narrow it down a ton, but c'est la vie. Domains used in the attack included: www .usgoodluck .com obama .servehttp .com prc .dynamiclink .ddns .us http://krebsonsecurity.com/2011/03/domains-used-in-rsa-attack-taunted-u-s/ http://krebsonsecurity.com/2011/03/domains-used-in-rsa-attac...
  - Estragon 16y ago
    Thanks.
Estragon 16y ago
It is also important to note that just as stealth fighters evade radar instead of defeating it, APTs do not “defeat” security products. Haha. You keep telling yourself that bucko.
- Groxx 16y ago
  "APT"? I don't know that acronym...
  - mukyu 16y ago
    http://en.wikipedia.org/wiki/Advanced_Persistent_Threat http://en.wikipedia.org/wiki/Advanced_Persistent_Threat
    - Groxx 16y ago
      Ah, many thanks :) It was being thrown around all over, but no explanation. >Threat – means that there is a level of coordinated human involvement in the attack, rather than a mindless and automated piece of code. The operators have a specific objective and are skilled, motivated, organized and well funded. Seems odd to specify "mindless and automated piece of code". Does this mean Stuxnet wasn't a "Threat"? I'd say it fit all those requirements - specific goal, wide-ranging tech use, and everyone saw it coming but nobody managed to stop it.
      - trotsky 16y ago
        Stuxnet definitely fits the definition (with a bullet). It's wikipedia with all the associated baggage. I'd guess what they meant to draw a distinction from was the automated bots/worms out there that just rattle the windows of hundreds of thousands of sites with for known vulnerabilities. Then they install something relatively innocuous like an ad for scareware AV similar to the current huge SQLi attack.
rst 16y ago
What RSA's SecurID customers really want to know is what specific information regarding SecurID got compromised, and what are the implications for the security of SecurID itself. Which neither RSA's official post[1], nor Gartner's writeup, seems to tell me. (Knowing the details of how RSA got spearphished is interesting, I suppose, but it leaves out the really important bits.) [1] http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/
r00fus 16y ago
Is this another reason to laud Apple for not shipping Flash on their Macs (or iOS devices for that matter)? Having a fully scriptable, ubiquitous environment like Flash installed systemwide just increases your attack vectors. I'm not blaming Adobe here as much as recognizing that 0-day vulnerabilities will always exist. Microsoft office aside (if you need to use, it's going to be installed), perhaps there will now be pressure to remove and ban Flash from work environments.

23 points by trotsky 16y ago

>The irony is that they don’t eat their own dogfood. In other words, they relied on yesterday’s best of breed tools to prevent and detect the attack. I don't think she understands what eating your dogfood means.

alecco 16y ago
In the following paragraph she mentions RSA didn't use another tool they sell to prevent this kind of attacks. I think she used the phrase correctly. http://en.wikipedia.org/wiki/Eating_your_own_dog_food http://en.wikipedia.org/wiki/Eating_your_own_dog_food
- kqueue 16y ago
  Can you copy that specific section?
  - Groxx 16y ago
    >RSA sells its own fraud detection systems based on user and account profiling ... They should have applied these techniques to their own internal systems. As they were using a network observer which wasn't as sophisticated as other tools they make and sell.
  - alecco 16y ago
    I don't know why you ask, it's right next paragraph to your quote. But let's save other people the time to check: > The irony though with RSA is that they don’t eat their own dog food. > In other words, they relied on yesterday’s best of breed tools to > prevent and detect the attack. They gave a lot of credit to NetWitness > for helping them find the attack in real time but they obviously weren’t > able to stop the attack in real time, which means the signals and > scores weren’t high enough to cause a person to shut down the attack > in real time. > > RSA sells its own fraud detection systems based on user and account > profiling which use statistical Beysian models, and rules, to > spot abnormal behavior and intervene in real time to re-authenticate > users and verify the authenticity of suspect access, behavior, or > transactions. (RSA appears in the leaders quadrant of Gartner’s 2010 > Web Fraud Detection Magic Quadrant). They should have applied these > techniques to their own internal systems. They need to stay innovative > and apply the lessons learned from serving their clients to their own > internal enterprise systems.

chair6 16y ago

I was really hoping it would be something at least somewhat interesting like an SQL injection vulnerability or some kind of 0-day (EDIT: in external facing system/service), for the sake of RSA. But no, it was email attachments (EDIT: granted, with an Excel 0-day). Email attachments???!! Says a lot about the effectiveness of security awareness training. Fear the APT.

blantonl 16y ago
It was a zero day vulnerability in Excel that caused the isse - those tend to easily have great impact.
trotsky 16y ago
If it's as they describe they did have a 0-day used on them. The email attachments, which were excel spreadsheets with an embedded flash exploit apparently were the source of the 0-day report documented in CVE-2011-0609 and published on Mar 14. The RSA attack was reported on Mar 17. https://www.adobe.com/support/security/advisories/apsa11-01.html https://www.adobe.com/support/security/advisories/apsa11-01.... While there is definitely something to be said for what you're saying about "omg, email attack" the other side of the coin is that spearphishing is the most popular/common attack vector because it works.
- chair6 16y ago
  I was thinking 'in external facing system/service' while I was typing 0-day but yes, you're right. Agreed on the spearphishing point.
- mryall 16y ago
  It's a good reminder that with ubiquity comes an increased focus on security. I'm much more conscious of the security problems with Flash after a lot of recent news about it. However, it isn't necessarily because it's any less secure than other applications, just that it's ubiquitous and therefore a more likely avenue of attack.
jws 16y ago
It came through an Excel document, but it appears to be an Adobe Flash security flaw, CVE 20110609

Pahalial 16y ago

I can't believe the person who wrote this is legitimately knowledgeable about this industry or the relevant tech. Phonetically misspelling "Bayesian" as "Beysian", while hardly a deal-breaker or even worth notice from someone non-technical, is a giant red flag from someone trying to sell themselves as a technically competent analyst.

trotsky 16y ago

RSA has posted a more detailed account to their blog: Anatomy of an Attack http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/

mukyu 16y ago
Sadly, it provides basically no details. Skip to the appendix if you don't want to read irrelevant comparisons to U-Boats and stealth aircraft. Even there, the details are light. They got spearphished with excel files with flash payloads (CVE-2011-0609). Those installed "Poison Ivy" (some remote admin a la vnc/rdp). They spread out from those points attacking other accounts/computers/servers. They looked around for interesting things, put it in passworded RARs and FTPed them out to other compromised (non-RSA) servers (apparently "Good[DOT]mincesur[DOT]com | up82673[DOT]hopto[DOT]org | www[DOT]cz88[DOT]net"). There is very little useful information in their breakdown. Everything they mention is standard fair, certainly not something special to "Advanced Persistent Threats". The flash vuln (with excel files) has been known for weeks. There is no discussion of what the attackers actually managed to get their hands on.
- trotsky 16y ago
  Agreed that all of the "omg, APT" in there comes off pretty badly in light of the reported details. APT has more or less been poisoned as a term lately (see comodo, etc.) and amounts to the latest scapegoat scenario. "See, we can't be blamed! It's an APT!" is what I'm betting the RSA board hopes is the take away here. Of course they could also know something pretty significant that they're not telling. What was taken and how tough it was to get at internally could be a flag. If there was a really significant or telling element to the attack it may well be that they've been asked not to reveal it. Not that I'd bet on that side of the line.

Estragon 16y ago

So, does everyone still think it's China? Have they been able to trace the IP addresses back, at all?

trotsky 16y ago
There is a US-CERT EWIN that makes it seem like either it was, or someone wanted people to think it was. Which does of course not narrow it down a ton, but c'est la vie. Domains used in the attack included: www .usgoodluck .com obama .servehttp .com prc .dynamiclink .ddns .us http://krebsonsecurity.com/2011/03/domains-used-in-rsa-attack-taunted-u-s/ http://krebsonsecurity.com/2011/03/domains-used-in-rsa-attac...
- Estragon 16y ago
  Thanks.

Estragon 16y ago

It is also important to note that just as stealth fighters evade radar instead of defeating it, APTs do not “defeat” security products. Haha. You keep telling yourself that bucko.

Groxx 16y ago
"APT"? I don't know that acronym...
- mukyu 16y ago
  http://en.wikipedia.org/wiki/Advanced_Persistent_Threat http://en.wikipedia.org/wiki/Advanced_Persistent_Threat
  - Groxx 16y ago
    Ah, many thanks :) It was being thrown around all over, but no explanation. >Threat – means that there is a level of coordinated human involvement in the attack, rather than a mindless and automated piece of code. The operators have a specific objective and are skilled, motivated, organized and well funded. Seems odd to specify "mindless and automated piece of code". Does this mean Stuxnet wasn't a "Threat"? I'd say it fit all those requirements - specific goal, wide-ranging tech use, and everyone saw it coming but nobody managed to stop it.
    - trotsky 16y ago
      Stuxnet definitely fits the definition (with a bullet). It's wikipedia with all the associated baggage. I'd guess what they meant to draw a distinction from was the automated bots/worms out there that just rattle the windows of hundreds of thousands of sites with for known vulnerabilities. Then they install something relatively innocuous like an ad for scareware AV similar to the current huge SQLi attack.

rst 16y ago

What RSA's SecurID customers really want to know is what specific information regarding SecurID got compromised, and what are the implications for the security of SecurID itself. Which neither RSA's official post[1], nor Gartner's writeup, seems to tell me. (Knowing the details of how RSA got spearphished is interesting, I suppose, but it leaves out the really important bits.) [1] http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/

r00fus 16y ago

Is this another reason to laud Apple for not shipping Flash on their Macs (or iOS devices for that matter)? Having a fully scriptable, ubiquitous environment like Flash installed systemwide just increases your attack vectors. I'm not blaming Adobe here as much as recognizing that 0-day vulnerabilities will always exist. Microsoft office aside (if you need to use, it's going to be installed), perhaps there will now be pressure to remove and ban Flash from work environments.