4 ms·
The majority of this post is RSA tooting its own horn for catching the attackers so quickly (along with other PR shenanigans). It'd be a nice if we could see a
by cookiecaper 16y ago
The majority of this post is RSA tooting its own horn for catching the attackers so quickly (along with other PR shenanigans). It'd be a nice if we could see a more detailed, straight-up technical version without all the pandering.
That said, the "new defense doctrine" against phishing and other impersonation scams should be, dun dun DUN, public key cryptography. It's not that complicated, and it would save so many people so much trouble if they actually used it. HBGary comes to mind, and now RSA; if RSA had even just signed its emails, not encrypted, this attack would not have happened. Kind of funny that a big firm whose whole business is based on this kind of cryptography wouldn't use it extensively itself.
- bigiain 16y agoIt'd also be nice if they answered the important question "was the private key securing all the deployed tokens stolen?". Knowing _how_ it happened satisfies some intellectual curiosity, but fundamentally hasn't shown us anything we don't know.
- deleted 16y ago[deleted]
- dekz 16y agoA number of employees within RSA do sign their emails. But there is this weird issue where you can only setup email signatures if you're a full time employee of RSA, not a contractor. But most do sign their emails. What surprises me is Poison Ivy, we were on the EMC network which was quite highly restricted, with all ports blocked apart from 80 and 443, even ssh was blocked over 443. So this method of using Poison Ivy would've had to have been on a popular site which was whitelisted which included most if not all of the social networking websites and online email. Not sure how data was "ftped" since that is also blocked.