8 ms·
How we found the file that was used to Hack RSA
- GBond 15y ago> So, was this an Advanced attack? The email wasn't advanced. The backdoor they dropped wasn't advanced. But he exploit was advanced. And the ultimate target of the attacker was advanced. If somebody hacks a security vendor just to gain access to their customers systems, we'd say the attack is advanced, even if some of the interim steps weren't very complicated. The whole post read to me as "meh. We haz hack for months. not impressed". But they neglected to mention the most sophisticated hacks of the whole incident: 1. cracked the vault/SCM of where the SecrueID token generation algo (generates a pseudo-random number) is stored 2. reverse engineered the SecureId token (ok, not that hard as apparently the crypto allowed regeneration the seed and associated token but still more sophisticated then a Excel/flash exploit) The whole Excel/Flash exploit was just to get through the patio screen door (equates to the same access an employee has). What was more serious and not mentioned was the attackers cracked the safe in the house.
- yalogin 15y agoIs there a description somewhere that talks about points 1 and 2 in greater detail?
- mbrzuzy 15y agoI was reading the article waiting for something about that too. It's a shame all it mentioned was that the hackers used a relic of a RAT (Poison Ivy) in combination with a spreadsheet + flash object.
- GBond 15y agoAgreed. One could argue that the post/title is totally linkbait. Plus they have a GIANT pic of the SecureID key fob but the content has nothing to do with it being cracked.
- anonymous246 15y agoI don't think you need to do (1) and (2). I posted earlier about this. RSA seems to have had a master list of seeds for ALL their customers' devices. They have a "control panel" of some sort which can resync RSA devices. Hence I'd guess that you only need a binary version of the control panel along with the list of seeds. The key problem here was that RSA needlessly kept their CUSTOMER's secret seeds.
- emcemployee 15y agoDisclosure: I work at EMC. It's sad to see that the most detail of the attack we employees of EMC have seen comes from an outside source. The infiltration clearly began by targeting EMC employee(s) not RSA. It's been many months since the attack with nothing being told to the employees whatsoever. I've even heard additional stories about other attempts at social engineering to gain more information recently. I'll answer questions that I can if anyone is interested but as mentioned above, we really aren't informed ourselves. To address your first point: I was under the impression seeds were stored for most(all?) customers for "bakcup" purposes. These were taken and matched against SecureID serials for use in more social engineering attacks (getting the other part of the two-factor auth).
- count 15y agoAre they still storing 'backup' seeds? Because to me, that sounds like a pretty huge target at this point.
- emcemployee 15y agoI cannot say for a certainty that they aren't as I'm not privy to that information. I'd hope with the new tokens released the backup of the information should rely on the owners infrastructure. RSA has been put on a secluded network away from EMC network.
- skcin7 15y agoForgive my ignorance but isn't the hash algorithm publicly known? Isn't "reverse engineered the SecurID token" basically have the same meaning as breaking RSA algorithm?
- iliis 15y agoThey hacked a company called 'RSA Security' [1] and not the cryptography algorithm RSA [2]. While the former is still interesting, the latter would be big news indeed. [1] http://en.wikipedia.org/wiki/RSA_Security http://en.wikipedia.org/wiki/RSA_Security [2] http://en.wikipedia.org/wiki/RSA http://en.wikipedia.org/wiki/RSA
- michael_dorfman 15y agoSince RSA Security is the company that supplies the tokens that are used to secure most banks and defense contractors, etc., and these tokens were in turn compromised via the hack, I would argue that this hack is still big news indeed.
- christoph 15y agoIndeed... Extremely interesting. Obviously a very advanced (team?) of people were involved in this and the whole story has only been hinted at. I personally would have expected much higher standards of security from a company selling security.
- Kadrith 15y agoTo me the worst part was how they managed the incident. They should never have been hacked, but once it happened they should have been honest about the scope of impact.
- iand 15y agoI'm sure they were very honest to their defense and security agency customers. First. Then the rest of the world.
- count 15y agoAs soon as notice that they had been breached was leaked, all the admins I knew assumed their keyfobs were compromised. Can you order RSA tokens WITHOUT them storing the seed for 'backup'?
- Luyt 15y ago"why the heck does Excel support embedded Flash is a great question" Gratuitously enabling embedding stuff like this in applications which don't really need it makes me always shudder when some software vendor is touting buzzwords like 'rich content' and 'rich user experience'. Most of the times it means unnecessary bloat, and as we can see from this example, a security hole too.
- gaius 15y agoPresumably because the Flash widget is OLE? You might as well ask why "enable" Flash over HTTP. The answer is of course that no-one "enables" anything, you write something generic like OLE or HTTP and people just use it for whatever they want to do.
- nikcub 15y agoIt is ActiveX. When you install Flash, it registers itself as an ActiveX object. If you run through your registry, you would probably be shocked to see all the different libraries that have been registered. To Microsoft's credit, running embedded ActiveX objects in Office is switched off by default. In large enterprise networks this can be set as part of a group policy. EMC must have switched it on. There is no granularity to it where you can say 'enable activex for video files but not for flash', so it is all or nothing. What you can do is set it to only allow embedded loads from the 'trusted' network, for eg. the intranet (a great feature which is rarely used). The reason why they attacked with an ActiveX exploit in an office document instead of a web page is because the office documents allow you to embed the entire object so that it is loaded locally - but newer Windows will still know that the original source is from the web, so it will treat it as such. EMC must have had liberal group policies. But you see the situation often - sales guys receive powerpoint presentations with embedded objects, or are creating them, and need it enabled. You can review the various objects you have registered in windows by going to HKEY_CLASSES_ROOT\CLSID in your registry, or using a tool such as: http://www.nirsoft.net/utils/axhelper.html http://www.nirsoft.net/utils/axhelper.html To change your Office security settings, see this msft article: http://office.microsoft.com/en-us/word-help/enable-or-disable-activex-controls-in-office-documents-HA010031067.aspx http://office.microsoft.com/en-us/word-help/enable-or-disabl... Edit: just to add, OLE is just the old ActiveX. OLE on COM was very difficult to implement - so Microsoft stripped it down, simplified it and called the new set of interfaces ActiveX.
- watty 15y agoHe said the Poison Ivy backdoor wasn't advanced - did the attacker create this trojan or is it something available? If it's available, why didn't the virus scanner catch it?
- jgrahamc 15y agoIt is easily available: http://www.poisonivy-rat.com/ http://www.poisonivy-rat.com/
- probablyrobots 15y agoIf this software is so widely available why didn't ECM's antivirus software detect it?
- statenjason 15y agoThis is answered in a response[1] to the grandparent post. "The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client." [1]:http://news.ycombinator.com/item?id=2928223 http://news.ycombinator.com/item?id=2928223
- waitwhat 15y agoThe reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client. The Poison Ivy client was downloaded to the target system. Why did the anti-malware software installed there not pick it up? (Attempting to hand-wave this away by talking about 0-day flash exploits really isn't answering the question.)
- zxw 15y agoIt's common for the free detectable version of popular trojans to be used as the advertisement for the paid undetectable one. Looking at the poison ivy website they have a customer portal, so presumably this is how they did it. There are also methods to pay without leaving a paper trail back to you (pre-paid cards I think). Edit: It's also possible to modify detectable executables to make them undetectable if you don't want to pay. Virus scanners for the most part work by reading a few bytes from an executable at a particular point, hashing those bytes and if they match a known virus, report it as one. By finding those parts of the executable (there are often multiple signatures, and different vendors will have different signatures too) and modifying them slightly, the resultant hash will be different and the executable undetected.
- forgotAgain 15y agoWhy isn't Outlook (or any email client) using a sandbox when opening attachments today? It would be a real benefit to users if the next version of Outlook had that virtual machine capability.
- eli 15y agoHow would that work? Is Excel also running in that VM? Not much of a sandbox.
- wglb 15y agoSandboxes are a fairly new idea, and they are hard to write, and hard to get right.
- sid0 15y agoMail clients (at least Outlook and Thunderbird) mark attachments as untrusted, and then it's up to the application to open them safely.
- mml 15y agoThe theory that this was an advanced persistent threat trying to get into Lockheed doesn't pass the smell test. Here are faster and easier ways to get ahold of an rsa fob.
- cookiecaper 15y agoA faster and easier way to get an RSA fob belonging to a person with access to Lockheed? It's not just about getting a generic RSA fob (afaik), it was about accessing the specific data of a client. Additionally, if the person was targeting other RSA clients, a seat inside the organization would become exponentially more valuable. It seems more safe to attack RSA from a distance over the internet and get the data you want than to try the old-fashioned physical infiltration method, into either the data center or to an individual's home where a fob could be found. Please correct me if I'm misunderstanding something.
- someone13 15y agoSlightly related: does anyone know how they found all the domains that were hosted on that IP? I've tried a couple of online tools, entering '119.70.119.30', and none seem to return anything.
- anoopks 15y agoYou normally need a reverse dns lookup tool like http://remote.12dt.com/ http://remote.12dt.com/ or http://whois.domaintools.com/ http://whois.domaintools.com/ or http://whois.webhosting.info/ http://whois.webhosting.info/ But none of these tools could find details of the above mentioned IP!
- someone13 15y agoI've tried a couple of online tools (the ones mentioned above, and a few more), and also dig: dig @<myDnsServer> -x 119.70.119.30 No dice on any of them. Also, I was under the impression that most times there's only one PTR record for a given IP, which means you'd get at most one domain name. Not sure about that, though.
- mseebach 15y agoThere can only be one PTR record, but there doesn't have to be one. "Reverse DNS" works by caching the forward ones and can thus only work for names it's seen.
- throwaway32 15y agoNot to be glib, but that isn't how reverse DNS works at all. http://en.wikipedia.org/wiki/Reverse_DNS http://en.wikipedia.org/wiki/Reverse_DNS
- p0ppe 15y agoGoogle "Reverse IP Lookup".
- snsr 15y agoI forward this file to you for review. Please open and view it. -web master I cannot fathom why anyone would open an attachment in an email like this. Someone at EMC has dropped the ball if an email from "web master" doesn't raise every eyebrow in the house.
- eli 15y agoI'm sure most people didn't open it. But it only takes one person.
- lawnchair_larry 15y agoIt shouldn't, that's the thing. Your employees should be able to get hacked without any one of them potentially exposing your crown jewels.
- eli 15y agoI agree. That why, as other comments have pointed out, this is not the interesting part of the hack.
- evilswan 15y ago> Turns out somebody (most likely an EMC/RSA employee) had uploaded the email and attachment to the Virustotal online scanning service on 19th of March. Would that be some automated system that sends samples - or would the user have to manually find the .msg file and upload it? Because I really can't see a generic 'office drone' at EMC uploading every bit of malware that comes into their inbox, especially if they're also likely to open this kind of dodgy-looking email...
- fleitz 15y agoYou just drag the message to the browser window, or the desktop, if you drag a message from Outlook to the desktop it is automatically saved as a .MSG
- jobu 15y agoIf anyone from F-Secure is reading this, can you give a link to the Virus Total report? I'm very curious which 18 of the 41 antivirus applications flagged this file: http://www.f-secure.com/weblog/archives/sra2011_3.png http://www.f-secure.com/weblog/archives/sra2011_3.png
- someone13 15y agohttp://www.virustotal.com/file-scan/report.html?id=dd987552c27854deb457b0ac3348545c775aa3f265f971f4c1892c8bfe2c01b6-1300557728 http://www.virustotal.com/file-scan/report.html?id=dd987552c... (Not an F-Secure employee, by the way)
- dredmorbius 15y agoJust wondering if anyone else noted the irony ... of demonstrating the vulnerability of opening a random Flash video by ... posting a random Flash video. In a security article. So: who among you still played that video? Just askin'.
- joeyh 15y agoI played it, but my laptop does not have flash installed, so nyah.
- gcb 15y agosome paradoxes... 1) by running an antivirus, your emails end up on some public searchable and discloseable database? 2) They couldn't hack RSA clients that were using rsid, but they could hack RSA itself? that's the worst case of not eating your dog food in history.
- jeffreyg 15y ago1) this is not just "an antivirus". VirusTotal is a website where you go and upload a suspicious file, and they scan it. Also, this says nothing about the file being "public searchable", it says it's made available for security industry professionals. 2) yes. typically you don't attack strong crypto, you find a weakness in its implementation. In this case, RSA Security's network was that weakness.
- ctz 15y agoOn the second point, a strong cryptosystem wouldn't have such a poor security design that RSA could break into any of its customer's networks. I'm sure a number of other RSA customers were surprised that RSA retained this power; I was.
- bkudria 15y agoDid you even read the article? 1) The file was uploaded manually by a security researcher. 2) They couldn't access a particular part of LM/NG protected by SecurID. They could've sent them an email also, they just wouldn't have gotten access to the information they needed. I'm sure RSA is using SecurID also, but someone somewhere fucked up and the attacker was able to find a security breach starting with the infected workstation. From there, it's easy to get personal info for social engineering, access network drives, etc. Look, if you have a determined, well funded country state hell-bent on cracking into your system, all the security in the world won't protect you.
- celoyd 15y agoIt’s a shame that they obscured incriminating details in the screenshots with simple image operations like low-radius 1- and 2-dimensional blurring. Using a guessable point-spread function on an image region with so many known characteristics (because we know the font) is very, very leaky. In this case it would not surprise me if someone could deconvolve the e-mail addresses enough to match them against EMC employee profiles and such. If you want to hide text in an image, you should, at minimum, replace every pixel in its bounding box. That still leaves spacing data, but it’s a start. Smearing or lightly jumbling the pixels is barely a notch more secure than rot13.
- biot 15y agoA neat trick would be to overwrite the original details (such as email subject) with something like "Did you really think you could unblur this?" in an identical font. With a security company, whose followers probably enjoy puzzles, you could go a step further and make a game out of it. For example, the unblurred text could contain a URL for a microsite that has a little game related to one of their products. It'd be fun and promotional at the same time. The downside is that this trains people to always try unblurring your blurred text and almost guarantees someone will find the one instance where somebody forgets to blur something.
- celoyd 15y agoHeh, yeah. I was amused by VesselTracker’s strategy. Go to at http://www.vesseltracker.com/en/Ships/Mv.-Deira-9149768.html http://www.vesseltracker.com/en/Ships/Mv.-Deira-9149768.html (for example) and look at the “blurred” pay-only data. Rot13 spoiler: it all says “Ab qngn sbe lbh!”
- buff-a 15y agoI was looking forward to how they sleuthed the thousands of computers at EMC/RSA to determine what the attack vector was and how they found the file. Instead, what I learned was that back in April they knew exactly what file it was, but they'd deleted it, and EMC doesn't back up its email.