RSA SecurID Breach

Security experts are still guessing at the true impact of the mysterious breach of security company RSA in 2011. What is known is that RSA's parent company, EMC, spent $66 million recovering from the attack, and that information relating to RSA's popular SecurID two-factor authentication mechanism was compromised.

What remains a mystery is exactly what that information was. RSA said the breach could reduce the effectiveness of SecurID, but did not say whether or not the SecurID source code or cryptographic seed values were exposed.

Another thing that is known about the attack is that it began with social engineering. As RSA explained in a blog post:

"The attacker in this case sent two different phishing emails over a two-day period. The two emails were sent to two small groups of employees; you wouldn’t consider these users particularly high-profile or high-value targets. The email subject line read '2011 Recruitment Plan.'

"The email was crafted well enough to trick one of the employees to retrieve it from their Junk mail folder, and open the attached excel file. It was a spreadsheet titled '2011 Recruitment plan.xls.'

"The spreadsheet contained a zero-day exploit that installs a backdoor through an Adobe Flash vulnerability (CVE-2011-0609)."

Ferrara lists this in his top five, because it was one of the first high-profile attacks against a security company, and it not only impacted the security of its initial target, but thousands of other organizations as well.

(image: photo of RSA Secure ID SID700 hardware token, by Rembert F. Ludovic, via Privacy Canada)