Attacks/Breaches
4/4/2011
11:28 AM
50%
50%

RSA Details SecurID Attack Mechanics

EMC won't say what the attackers took, but it did explain how they penetrated RSA and stole information about its two-factor SecurID authentication system.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
EMC's RSA division has that it was compromised by a spear-phishing attack -- aka spoof emails -- that used a zero-day Adobe Flash vulnerability. But RSA still offered no details on the information the attacker stole.

Here's how the attack succeeded, according to what RSA reported Friday: The attacker sent two small batches of emails with "2011 Recruitment Plan" as the subject line to two small groups of EMC employees with an Excel spreadsheet attached, which at least some recipients executed. But the spreadsheet included an embedded Flash file that executed malicious code via a zero-day vulnerability, enabling the attacker to gain full access to the PC and install software to more easily control it remotely.

"The attacker in this case installed a customized remote administration tool known as Poison Ivy RAT variant," said Uri Rivner, head of new technologies in the consumer identity protection group at RSA, in a Friday blog post.

Rather than receiving commands from a control server, tools such as Poison Ivy pull commands from an external server. "This connectivity method makes them more difficult to detect, as the PC reaches out to the command and control rather than the other way around," he said. Poison Ivy has been used in numerous other attacks, including the Operation Aurora attack against Google in late 2009.

After penetrating EMC's network, the attacker targeted credentials for people with access to high-value information, aggregated that information, and then exported it via FTP to an external Web site, where it was downloaded and then erased -- evidence of the attacker hiding his or her tracks.

Rivner emphasized that RSA had been hit by an advanced persistent threat (APT) attack. "One cannot stress enough the point about APTs being, first and foremost, a new attack doctrine built to circumvent the existing perimeter and endpoint defenses," he said.

But many security experts have labeled "APT," at least in this case, as an exercise in spin, noting that threats that blend multiple attack modes, including social engineering, have been around for years.

"There is very little in this attack that is particularly sophisticated. The big question is, what are the defenses that would have prevented or reduced the impact of this attack?" said Rick Wanner at the SANS Internet Storm Center in an online post.

As noted, RSA's Rivnerk also offered no additional information on exactly what the attackers stole, saying only that "RSA made it clear that certain information was extracted."

That lack of specificity from RSA left many SecurID users preparing for the worst, which is that their two-factor authentication system can't be trusted.

Adobe has since patched the vulnerability exploited by the RSA attacker.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0547
Published: 2015-07-04
The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0548
Published: 2015-07-04
The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0551
Published: 2015-07-04
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P2...

CVE-2015-1966
Published: 2015-07-04
Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafte...

CVE-2015-4196
Published: 2015-07-04
Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report