4 ms·
> So, was this an Advanced attack? The email wasn't advanced. The backdoor they dropped wasn't advanced. But he exploit was advanced. And the ultimate target of
by GBond 15y ago
> So, was this an Advanced attack? The email wasn't advanced. The backdoor they dropped wasn't advanced. But he exploit was advanced. And the ultimate target of the attacker was advanced. If somebody hacks a security vendor just to gain access to their customers systems, we'd say the attack is advanced, even if some of the interim steps weren't very complicated.
The whole post read to me as "meh. We haz hack for months. not impressed".
But they neglected to mention the most sophisticated hacks of the whole incident:
1. cracked the vault/SCM of where the SecrueID token generation algo (generates a pseudo-random number) is stored
2. reverse engineered the SecureId token (ok, not that hard as apparently the crypto allowed regeneration the seed and associated token but still more sophisticated then a Excel/flash exploit)
The whole Excel/Flash exploit was just to get through the patio screen door (equates to the same access an employee has). What was more serious and not mentioned was the attackers cracked the safe in the house.
- yalogin 15y agoIs there a description somewhere that talks about points 1 and 2 in greater detail?
- mbrzuzy 15y agoI was reading the article waiting for something about that too. It's a shame all it mentioned was that the hackers used a relic of a RAT (Poison Ivy) in combination with a spreadsheet + flash object.
- GBond 15y agoAgreed. One could argue that the post/title is totally linkbait. Plus they have a GIANT pic of the SecureID key fob but the content has nothing to do with it being cracked.
- anonymous246 15y agoI don't think you need to do (1) and (2). I posted earlier about this. RSA seems to have had a master list of seeds for ALL their customers' devices. They have a "control panel" of some sort which can resync RSA devices. Hence I'd guess that you only need a binary version of the control panel along with the list of seeds. The key problem here was that RSA needlessly kept their CUSTOMER's secret seeds.
- emcemployee 15y agoDisclosure: I work at EMC. It's sad to see that the most detail of the attack we employees of EMC have seen comes from an outside source. The infiltration clearly began by targeting EMC employee(s) not RSA. It's been many months since the attack with nothing being told to the employees whatsoever. I've even heard additional stories about other attempts at social engineering to gain more information recently. I'll answer questions that I can if anyone is interested but as mentioned above, we really aren't informed ourselves. To address your first point: I was under the impression seeds were stored for most(all?) customers for "bakcup" purposes. These were taken and matched against SecureID serials for use in more social engineering attacks (getting the other part of the two-factor auth).
- count 15y agoAre they still storing 'backup' seeds? Because to me, that sounds like a pretty huge target at this point.
- emcemployee 15y agoI cannot say for a certainty that they aren't as I'm not privy to that information. I'd hope with the new tokens released the backup of the information should rely on the owners infrastructure. RSA has been put on a secluded network away from EMC network.
- skcin7 15y agoForgive my ignorance but isn't the hash algorithm publicly known? Isn't "reverse engineered the SecurID token" basically have the same meaning as breaking RSA algorithm?