Slashdot Mirror
RSA Says SecurID Hack Based On Phishing With Flash 0-Day
Trailrunner7 writes "RSA confirmed on Friday that the attack that compromised the company's high-value SecurID product was essentially a small, targeted phishing campaign that included a payload of a malicious Flash object embedded in an Excel file."
Why jobs doesn't want that POS on Iphones or Ipads!
Or OCX (OLE, etc) lets another wolf into the flock. Embed by default is broken, and well terrifying.
The Geek in Black
I know my BCD's (when I'm Sober)
.. for the all-present loophole known as FLUSH (and as Flash in your HQ) and also to MicroSoft for their mega-secure OLE, etc, etc
Sad part is trying to live without Flush and MS, is darned near impossible. The other massive and all-present loophole, also (hmm, note this) from ADOBE if PDF..... they should stick to writing PhotoShop and can all the other stuff they have tried and messed up.
Set spam folder to auto-delete incoming.
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
You can embed flash in excel files!? WHY WOULD YOU DO THAT
has the securid seeds database been compromised?
anything else you announce is fluff.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
NotSoSecurID
Is there a way to set up a server "A" that computes some function f(x) for values of x coming from a networked computer "B", and sends the result f(x) back to B, without any chance of any hacker getting hold of the code for f(x)? Some kind of special network that can only send x in one direction, f(x) in the other, and clearly never do anything else even if machine B gets compromised?
"BIATCH confirmed on Friday that the attack that compromised her high-value NoPrego product was essentially a small, targeted phushing campaign that included a payload of a malicious Flesh object embedded in a broken Trojan."
Don't fight for your country, if your country does not fight for you.
... would I have fallen for such a phishing attack? And the answer is - yes, quite probably
and I wonder, how would I protect against it? And I come up with very few practical ideas.
Anyone?
Because you can and it makes you kewl!
It's like how /. fucked this site up with JavaShit up the ying-yang because the dumbasses thought that would spiff it up to compete with dogg. All it did for me is make me come here far less often.
Cheers,
A Bof
If they were to add a .nexls (non executables or something similar) file type that companies needing a bit of security could use that only had stuff a normal spread sheet has values, borders, charts, formulas ... (and something similar for word).
Of course it would be hard to add new features to these versions and therefore sell updates and completing products would be able implement the standard pretty quickly.
... the Microsoft products used in it.
Anons need not reply. Questions end with a question mark.
Microsoft, Adobe, e-mail and stupid people. Seriously, the internal security is just as important as external - too bad almost no large organization heeds these warnings and continues to trust all their users and their computers as being safe and secure. My organization thinks because you're on the internal network, you don't need encryption necessarily for passwords and the like, they actually call it the Secure Network whereas the unencrypted wireless and the network that links up to external providers are the only insecure network.
Custom electronics and digital signage for your business: www.evcircuits.com
At my work we used to use the RSA token and a 4 number PIN that never changed to log into the network (as well as the regular username and password). Five failures to log in would get your account locked out.
Now we have to use our RSA token and an 8 letter/number PIN that changes every 30 days(!) to log into the network (as well as the regular username and password), and the system locks out accounts after only 3 failed log-ins.
They are obviously relying _much_ more heavily on the user selected PIN than before, almost to the point that the token output is irrelevant.
The social engineering actually happened years before the "attack." Someone has been going around to businesses and telling them that it's ok for non-experts (i.e. people who don't know that loading a "document" into MS Word or MS excel is equivalent to "chmod u+x document; ./document") to run MS Office on computers that have email or other internet access.
RSA's blog about this is sickening. They act like this is a new type of attack, comparing to having your radar-defended country attacked by stealth bombers. Yet in real life, everybody has known about this risk and been talking about it for 15-20 years. Yes, even the fact that the attacker should send the "document" to the right person (if for no other reason, to get that person's permissions, rather than to exploit anything special about their behavior, other than their willingness to execute untrusted "documents"). The only thing new about this, is that this is the first time it ever happened to RSA themselves (that they know of).
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Nowadays anyone with a brain should know to stay clear of Microsoft's Windows operating system if they don't want to end up with a virus infested machine and security problems. This person clearly did not have Linux on their computer.
And this "event" does too.
In a week or so they will admit that "some seeds" were stolen, a week or two later, it will be a "significant number of seeds" and some more weeks later it will be "all seeds".
The real question is however this: Why the hell were the seeds accessible over the network? Are these people totally and utterly incompetent? Even the mere possibility of a seed database compromise over the net (and they have indirectly, but conclusively confirmed this, as it is the only part of the system that must remain secret) is proof of gross incompetence and mandates a move to a different vendor. Nothing RSA does henceforth can be trusted to be secure, as some important part of that company (my guess: management) does not get how security works.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
watch the RSA stock plummet, time to buy entrust!!!!!
> RSA confirmed on Friday that the attack that compromised the company's high-value SecurID product was essentially a small, targeted phishing campaign that included a payload of a malicious Flash object embedded in an Excel file." ..
Don't open email attachments on a Windows computer that is used to control your SecurID product ...
If the software that scans incoming email for threats flags a particular piece of email and puts it in your junk folder, why not have that be a permanent resting place. Once something is in junk, the use can only do a limited number of things: 1) View Sender, Receiver, Date, Subject 2) View message header as text 3) Delete item
The user then cannot move the item from the junk folder and there would be a variable length housekeeping delete that the administrator can set to one month or whatever.
Basically, once something is junk, it can't come back. Parts of it can be examined, but that's it. Enough of it can be examined so that if it is legit, the receiver can see what the problem is and the sender can send it in a different way.
I mean, it's not like there are no known Linux exploits, but -- when you've got average users using windows for day-to-day work, it's just a matter of time....
Security by obscurity, but -- among other things -- the attacker would, have to figure out that you're not using Windows.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
So I look at the file, and it's an excel file that implies a list of recruits. What part of an organization is tied completely to the Microsoft suite? (hint, they only communicate through email using attached .DOC files) Which part of the organization is concerned with "recruiting?" Which part of the organization is despised as being filled with overpaid idiots?
RSA was brought down by their Human Resources Department. Someone retrieved an email from their junk box, from someone they didn't even know, and RAN AN ATTACHMENT AND PROBABLY HAD TO IGNORE A WARNING MESSAGE TO TURN ON ACTIVE CONTENT. They probably had admin rights on their machine because admin rights are considered a privilege of rank rather than of strict necessity, which Human Resources implicitly allows.
Anybody on LinkedIn? See if there are any recent departures from RSA from HR.
As others have observed there was nothing particularly sophisticated in this attack – it is pretty much standard stuff that I almost see on a day to day basis.
The key here is that taking control of those “low profile target” users (which could have been avoided in this specific case using good security policies) should never allow further escalation to the keys of the kingdom That in itself is very troubling for a company like RSA which should have much tighter security. Braging about this being such an incredibly smart attack is also worrying - are they living in a cave ?
The next step is now full disclosure about what has actually been compromised. No more corporate PR, just the straight facts. And frankly apart from the seed database I don't know what could really be of real interest.