Slashdot Mirror
RSA Blames Nation State For Cyber Attack
An anonymous reader writes "Security firm RSA has revealed that it believes two groups, working on behalf of a single nation state, hacked into its servers and stole information related to the company's SecurID two-factor authentication products. Speaking at the RSA Security Conference in London, RSA executive chairman Art Coviello described the high profile attack thus: 'There were two individual groups from one nation state, one supporting the other. One was very visible and one less so. We've not attributed it to a particular nation state although we're very confident that with the skill, sophistication and resources involved it could only have been a nation state.' Sophos security researcher Graham Cluley questions how RSA has concluded that a country was responsible for the attack — when RSA is unwilling to name who it suspects. Could it be that the firm is simply applying spin, describing the attack as a 'highly sophisticated Advanced Persistent Threat' to protect its image?"
China
In soviet russia the government regulates the companies.
Maybe whoever wrote the virus got lucky, found they'd hit the jackpot with the data and sold it off for a crapload of money?
What is the point of the internet?
Iran for an attempted attack on us soil just today. Maybe they figured (or were coaxed *tin foil hat) that they should just add blame to iran to either to save face (most likely) or to add ammo to the fact that they did in fact back the attack?(end tin foil hat)
have you seen my sig? there are many others like it but none that are the same
Any design that held all the keys in a central database that was not changeable by the end-user organization was defective-as-designed, IMHO.
Yah an it was a COUNTRY that did it mommmmmieeeeeeeeeeeeeeeeeeeeeeeeeeeeeee!
Seven puppies were harmed during the making of this post.
They only have themselves to blame if their threat modeling didn't take into consideration a possible attack from an entity with the means of an intelligence service or nation. Either that, or they sold their customers a false sense of security.
Im not at all surprised that they are not saying what nation they suspect.
RSA cannot prove, beyond reasonable doubt, which country is the criminal. Naming any country without significant proof will cause more harm than good.
They suspect a nation, but without better proof, the media shitstorm that inevitably results, will cause far more harm to the company than the hack itself has.
"Security firm RSA has revealed that it believes two groups, working on behalf of a single nation state, hacked into its servers and stole information related to the company's SecurID two-factor authentication products."
Yea real fucking secure there chief.
Fuck it up, then blame china. its the new scapegoat for i.t. incompetency.
Read radical news here
RSA should never have allowed systems containing anything related to SecureID beyond marketing data be connected to a network with an Internet connection. SecureID development should have been restricted to a physically separate (air-gapped) network.
Why would I ever want to trust any security company who would make such a fundamental mistake?
I would expect such from most companies. But from a company that sells computer security products?
And those products DEPEND upon the seed being secret?
I get the feeling that they're claim this now (MONTHS after the crack) in order to justify their failure.
Who cares if it was a single cracker or a cracker group or a nation employing crackers? If they didn't go in with gunships then it is the same in the end. A cracker got past their defenses and all the way into their vault.
Why was the vault available on-line like that?
...because having to admit "we got 0wned by some random script kiddie" would be just too embarrassing.
. . . in Chinese?
So why is no one auditing these claims of security by RSA... ...But they had pretty pictures in there presentation....
I guess they left is all on a public FTP...
RSA is just another scumbag big corp stealing from other lazy big Corp...
Meanwhile, two teenage boys are laughing their asses off. The would have continued but it was a Warcraft raid night.
There are lots of groups who would love to have a copy of RSA's SecurID database. Frankly, I don't really care what part of the world the attackers came from. The bottom line is that RSA messed up big time with some very basic stuff. I don't see them as a victim and am a little disturbed that their chairman would have anything other than apologies for their incompetence and poor handling of the situation after the attack. It would be nice for him to also explain how this type of attack could not succeed again.
It really doesn't matter whether this was a targeted, sophisticated attack or not. The fact is that if RSA had done a decent job of securing its keys it wouldn't matter who was attacking them.
Any company with secret keys remotely as valuable as RSAs should have generated them and managed them ONLY in high-security HSMs (host security modules) configured to refuse to ever divulge the keys under any circumstances, except to securely transport them to another HSM. That plus reasonable logical access controls on the HSMs, with separation of authority for all important operations, and strong physical security around the HSMs makes it virtually impossible for any attacker, no matter how skilled, sophisticated or well-funded, to get at the data.
This really isn't rocket science. Lots of banks and lots of other security-conscious companies do this sort of thing all the time. Given who RSA's clientele was, if they'd gone to the NSA and asked for help they'd have gotten all the free consultation they needed from some of the best there are, if they'd needed it. Which they shouldn't have.
Whether it was a sophisticated team from a world superpower or a couple of random script kiddies is really just a question of how much gross negligence.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
RSA has good reason to make the attackers as scary as they can. After all, from the details available it sounds like this was a relatively easy hack. Advanced, but easy. If they admit that, they look like the incompetent and arrogant hacks they apparently are.
My advice is to not buy anything from them at least for a few years.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
... A sheepish interopter of dubious philogeny and known lack of brains.
LOL
If RSA is reading this, could you give us a hint as to what country it could be. For example, could you tell us if the nation state rhymes with the word "vagina".
I spend a week a year listening to crap like this for hour after hour. In 2010 everyone said (and still this year the big Security firms are still clueless) that the PLC attack against the Siemens controllers "Was an extremely sophisticated attack" blah blah blah "nation state" blah blah blah.
This is based on the following:
1. Obviously the 2 signed pieces of code would have required real human assets.
2. The PLC controllers are incredible sophisticated and expensive.
3. The method of infiltration was extremely well planned.
Until earlier this year I was spouting the same crap... then an individual busted Comodo wide open. Then later Diginotar (as if Comodo wasn't evidence enough.) SO Check, #1 no longer requires human assets.
Then I saw a talk that blew #2 and #3 out of the water. A relatively low funded talk ( about 6k) was done, where an individual (not a team, not even two people) was able to identify a direct backdoor that provided shell access into all PLCs of the model applicable in the Stuxnet attack, and could perform the attack without the need of the configuration stations...
THERE WAS NO NEED FOR A USB PAYLOAD TO BOOTSTRAP THE COMPILER! You could actually login, and patch the damn executables on the plc itself using the backdoor.
My conclusion about 30 seconds after these things were demonstrated (on the actual PLCs) was that it probably did take a team of engineers to create the rube goldberg that was stuxnet, but it didn't involve anyone at Siemens (since when confronted with the researchers findings, they acknowledged them, saying they were already aware.)
Since the RSA attack is like three steps down from that, I would say that RSA is trying to perform damage control with their shareholders since in terms of sophistication a user clicking a malicious URL in an email is sooooOoo 1999.
The article is correct. APT is merely a buzzword to throw around to make the attack sound sophisticated. It was certainly a good attack, but it's hardly something that requires the resources of a "nation state". Individuals are constantly finding software flaws that are more sophisticated than what RSA was hit by. The attack merely combines social engineering (getting the victim to open the spreadsheet), a hidden payload of Flash packaged inside it, and a flash exploit. None of those are really that sophisticated, or particularly new.
I don't think any details have been given about what happened once the initial machine was owned. But given that RSA is already trying to hack into something resembling "the hack of the century", AND the fact they didn't reveal tokens had been stolen until AFTER a stolen token was used in a Lockheed Martin attack, I'd say the opinion of RSA on who was involved can't be trusted.
Speculation of the attacker based on who has an interest in breaking Lockheed Martin is meaningless. I could come up with a dozen different explanations, all equally plausible that wouldn't involve a nation state at all. Perhaps the first attacker breached RSA, then sold the stolen tokens to some other hacker. Without evidence to keep us honest, we can make up whatever theories we like.
AccountKiller
I'm sure it was a nation state, but RSA is a disorganized circus internally, so I'm sure it wasn't that hard to hack them.
They are way sneeker than most people (Americans) think...
Might as well claim a Leprecaun did it given the evidence RSA isn't coughing up.
why didn't they use their own technology for security (at least, I'm assuming they didn't) ? Because I haven't heard of anyone proving the Reimann hypothesis....
Actually, Iran is one of the currently most active APA (Advanced Persistent Adversary) .
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
n/t
1. Make up big numbers ....
2.
3. Profit!
Worked for years, until:
4. Totally Fuck Up the very thing you depend on
5. Cry Espionage
6. Bankrupt.
Bye!
haha, i am amazingly surprised that no one suspects USA!
USA is the most innocent riiighht?
USA isn't the one who is ditching privacy for your public security, right?
oh yeah..
Which is handy, because they'd have been really screwed if A Wizard Did It.
If you were blocking sigs, you wouldn't have to read this.
So much shit is being piled on Iran, most of it without any evidence. Seems quite obvious Iran will be next in line after Afghanistan and Iraq. And not just geographically. Such sickening propaganda smear.
Could it be that the firm is simply applying spin, describing the attack as a 'highly sophisticated Advanced Persistent Threat' to protect its image?
Let me make a quick change. That is a question, so let's make it a statement. Also, let's change a few words and.... *Cartman voice* There we go:
"The firm is simply applying spin, describing the attack as a 'highly sophisticated Advanced Persistent Threat' to protect an image... An image that their services are worth money."
/snark
I'm not saying that they aren't, I'm just sayin', man... I'm just sayin'.
http://toolbar.netcraft.com/site_report?url=http://www.rsa.com
Hosting History
Netblock Owner IP address OS Web Server Last changed
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 5-Sep-2011
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 25-Jul-2011
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 31-May-2011
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 21-Apr-2011
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 20-Mar-2011
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 unknown Microsoft-IIS/6.0 19-Mar-2011
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 18-Mar-2011
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 4-Sep-2010
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 23-Mar-2010
RSA Security Inc. 174 Middlesex Turnpike Bedford MA US 01730 216.162.240.32 Windows Server 2003 Microsoft-IIS/6.0 21-Mar-2010
It's not an RSA issue. It's a Two factor issue.
Two factor has well known / inherint weaknesses.
Here is what 2 factor has going for it: it's simple, dirt cheap, and works most of the time.
This wasn't stuxnet. It was Excel.
http://www.f-secure.com/weblog/archives/00002226.html
Join the Slashcott! Feb 10 thru Feb 17!
Check this out:
we're very confident that with the skill, sophistication and resources involved it could only have been a nation state.'
Now look at this:
http://www.h-online.com/security/news/item/RSA-break-in-it-was-the-Flash-Player-s-fault-1221057.html
RSA said that two variants of infected emails with an attachment called "2011 Recruitment plan.xls" were sent to a group of RSA employees over two days. Apparently, one of the targeted employees retrieved the email from a spam folder and opened it. The intruders used the exploit to install the widely known and freely available Poison Ivy "remote administration tool". The tool allowed the attackers to spy on the user's server access credentials, log into the server and escalate their access privileges (via further vulnerabilities). This gradually allowed them to work their way into the systems that interested them.
There, they harvested data and copied it to other servers on the internal network, where they combined, compressed and encrypted the information before transferring it to an external FTP server.
OH NOES SUCH UBER-L33T TACTICS! IT MUST BE TEH CHINESE CYBER-MARINES!
"When information is power, privacy is freedom" - Jah-Wren Ryel
Generic statements are going to be generic. I've read a few in the past few days:
"it's a nation state, we're not going to tell you which" (or you're just bullshitting)
"the public is going to be amazed when they find out the secret interpretation of the amendment. It's so horrible. I know what the secret interpretation is, but when you'll find out, you will be in awe." (FUD)
"we killed Osama, but didn't take any pictures and dumped the body in the ocean" (ORLY?)
I shouldn't be surprised though, given the number of people that believe there's an invisible man in the sky. Compared to that, the statements above seem like facts.
Not that they're incentivized to do this, but Microsoft or any of the Silicon Valley tech powerhouses could engineer a complex and sophisticated attack on the level of Stuxnet. It doesn't have to be a nation-state.