Slashdot Mirror
RSA Says SecurID Hack Based On Phishing With Flash 0-Day
Trailrunner7 writes "RSA confirmed on Friday that the attack that compromised the company's high-value SecurID product was essentially a small, targeted phishing campaign that included a payload of a malicious Flash object embedded in an Excel file."
Or OCX (OLE, etc) lets another wolf into the flock. Embed by default is broken, and well terrifying.
The Geek in Black
I know my BCD's (when I'm Sober)
.. for the all-present loophole known as FLUSH (and as Flash in your HQ) and also to MicroSoft for their mega-secure OLE, etc, etc
Sad part is trying to live without Flush and MS, is darned near impossible. The other massive and all-present loophole, also (hmm, note this) from ADOBE if PDF..... they should stick to writing PhotoShop and can all the other stuff they have tried and messed up.
You can embed flash in excel files!? WHY WOULD YOU DO THAT
has the securid seeds database been compromised?
anything else you announce is fluff.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
"BIATCH confirmed on Friday that the attack that compromised her high-value NoPrego product was essentially a small, targeted phushing campaign that included a payload of a malicious Flesh object embedded in a broken Trojan."
Don't fight for your country, if your country does not fight for you.
Um, not opening Excel or Flash files on computers that access the database would be a start. Furthermore sanboxing, and lots of it. Not running the most insecure OS on the planet would help too. The people at RSA really should have known better.
Monstar L
Why jobs doesn't want that POS on Iphones or Ipads!
Easily turned around. Considering it was phishing based attack, you could quite as easily say its no wonder that Jobs doesn't want people actually using iPhones or iPads as anything other than toys.
How does that even make any sense? iOS is quite secure, including not being vulnerable to Flash exploits, and if Steve Jobs only wants people to use iOS as "toys", why does Apple sell five creative and business apps for it?
The only thing you got correct in your post is that this was a phishing attack.
Don't open anything flagged as spam until you've read the full headers?
Don't use Excel as your first option when reading e-mail attachments?
Run off of a read-only file system?
Convert every excel file to CSV before opening?
View using Google Docs or one of its clones? (Not that I advocate using Google's tools in general...)
Open nonessentials on a different computer with restrictive security settings? Don't use Windows?
The possibilities are endless.
Realistically, it's not possible to stop an attacker who's willing to invest serious time and approach in a smart manner. It is, however, possible to avoid being the person in the organization who lets them in. Someone will fall for it, given enough time and a large enough company, and once they have access they won't be interested in tricking you anymore.
Usually as employee you cannot decide that.
The Tao of math: The numbers you can count are not the real numbers.
Not running the most insecure OS on the planet would help too.
Where in the article they say that OSX is being used?
They haven't stated how the hackers progressed from the low value employee workstations to higher value systems...
Although this is just a guess, based on my experience of other organisations they typically use active directory to manage everything from low level employee workstations, to high value servers... Elevating yourself from a low value workstation to domain admin using tools such as incognito, lsadump or hash passing is relatively easy and from there you have a very good chance of getting access to crucial systems...
Even in companies which try to separate critical functions away from general office stuff (which i would assume RSA did) if you take over the sysadmin workstations (which usually are linked to the active directory domain) then you can start keylogging or hijacking their existing sessions and getting into other stuff. Some companies also have central databases containing passwords protected by something as weak as active directory!
Including not being vulnerable to Flash exploits?
Not being able to run something is a curious criterion for invulnerability.
If we were to think like this, why not migrate to Multics. It's "not vulnerable" to almost anything under the sky.
Mostly harmless.
Corporate IT security is like a slot machine that costs 25 cents to play, with a payout schedule that pays $1 on average, but one out of every 1M pulls you lose $10M.
The IT manager who ultra-secures their systems gets tons of complaints, and the company becomes less nimble than their competition who don't bother to secure (there is a real cost when you make it harder for your employees to communicate and work together).
So, if you're an IT manager who promotes strong security you quickly lose your job to somebody who doesn't.
Then every once in a while one of these insecure managers pulls the lever and loses the company a lot of money. The manager is blamed for lax security and fired. The replacement will start out being more secure, and once the spotlight is off they'll go back to doing exactly what their predecessor did, and they'll get bonuses because there isn't a repeat of the huge loss and things are just as efficient as before. That must mean he is doing his job right, right?
I've been finding that successful executives these days really are just lucky. They enact risky policies that have short term gains, pocket bonuses from these gains, and try to move on before it comes back to hurt them. Many get terminated, but those who don't shoot way up the ladder. What passes for due diligence at the CxO level isn't about preventing problems, but instead punishing whoever was left standing without a chair when the music stopped.
At my work we used to use the RSA token and a 4 number PIN that never changed to log into the network (as well as the regular username and password). Five failures to log in would get your account locked out.
Now we have to use our RSA token and an 8 letter/number PIN that changes every 30 days(!) to log into the network (as well as the regular username and password), and the system locks out accounts after only 3 failed log-ins.
They are obviously relying _much_ more heavily on the user selected PIN than before, almost to the point that the token output is irrelevant.
The social engineering actually happened years before the "attack." Someone has been going around to businesses and telling them that it's ok for non-experts (i.e. people who don't know that loading a "document" into MS Word or MS excel is equivalent to "chmod u+x document; ./document") to run MS Office on computers that have email or other internet access.
RSA's blog about this is sickening. They act like this is a new type of attack, comparing to having your radar-defended country attacked by stealth bombers. Yet in real life, everybody has known about this risk and been talking about it for 15-20 years. Yes, even the fact that the attacker should send the "document" to the right person (if for no other reason, to get that person's permissions, rather than to exploit anything special about their behavior, other than their willingness to execute untrusted "documents"). The only thing new about this, is that this is the first time it ever happened to RSA themselves (that they know of).
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.