Was This the Phishing E-mail That Took Down RSA? 165
alphadogg tips this IDG News report: "'I forward this file to you for review. Please open and view it.' As a ploy to get a hapless EMC recruiter to open up a booby-trapped Excel spreadsheet, it may not be the most sophisticated piece of work. But researchers at F-Secure believe that it was enough to break into one of the most respected computer security companies on the planet, and a first step in a complex attack that ultimately threatened the security of major U.S. defense contractors including Lockheed Martin, L-3, and Northrop Grumman. The e-mail was sent on March 3 and uploaded to VirusTotal a free service used to scan suspicious messages, on March 19, two days after RSA went public with the news that it had been hacked in one of the worst security breaches ever."
Lessons are all standard (Score:2)
Re: (Score:2)
Anyone who takes security very, very seriously because they have to will talk to you about the Air-Gap. It's a beautiful thing.
Unfortunately, the Sneaker Net can easily defeat the air gap. Of course, the Epoxy Filler Plug defeats Sneaker Net.
So now we have the security geek version of Rock Paper Scissors Spock...
Re: (Score:2)
the Sneaker Net can easily defeat the air gap
IOW, Nike Air defeats Air Gap.
Re: (Score:2)
.. and that excuses it how? IT should set group policy to force that option off and expose it.
We also all know what a disaster having Microsoft involved with any kind of security beyond "feel-good" measures is. No, there is no good-fitting better alternative, but that doesn't change the fact that it's a mess.
Re: (Score:3)
You mean the file extension that actually matched what the file appeared to be (Excel spreadsheet) and had nothing at all to do with the reason this attack was successful?
If I may paraphrase JoshuaZ's point, it was "Turn on file extensions, and don't open files with suspicious extensions". It was also unrelated to this particular security breach, but at least it's still good advice in general.
You could even search through the Windows registry for registered file types with a "NeverShowExt" value set and del
Warning about FTA (Score:4, Insightful)
Looking closer, Hirvonen found that the file seemed to match RSA's description in possible every way.
I assumed this was a poorly translated phishing article and immediately closed my browser window and reinstalled Windows.
No really new news ... (Score:2)
"That's a pretty embarrassing example for RSA," he said. "It tells you that in any reasonably sized company, including a security company, there's someone who will do something really dumb."
The world's second oldest profession has been exploiting that weakness forever. They key to information is not to compromise the leaders; you get in via the support staff. They're not thinking security. It's amazing what a simple phone call can net in terms of information; even if you are up front with what you are looking for and why you want it. The internet just makes it easier to reach them and provides new tools to extract information.
Re:No really new news ... (Score:5, Insightful)
I wouldn't necessarily say it was something "really dumb". It looked like a legitimate e-mail from a legitimate contact, exploiting a zero-day flaw in a system. From a user standpoint, I'm not sure they could have done anything different to avoid getting infected. Users still have to get their work done. Your average user can't spend twenty minutes researching every attachment to make sure it doesn't have a zero-day attack in it.
That said, could RSA as an organization have done anything different to prevent this? Of course they could have, starting with not running an OS that's two major revisions out of date (let's not get into a Windows vs. *nix discussion here). But let's not put all the blame on the user for this.
Re: (Score:2)
I wouldn't necessarily say it was something "really dumb". It looked like a legitimate e-mail from a legitimate contact, exploiting a zero-day flaw in a system. From a user standpoint, I'm not sure they could have done anything different to avoid getting infected. Users still have to get their work done. Your average user can't spend twenty minutes researching every attachment to make sure it doesn't have a zero-day attack in it.
While I agree with you in general, and would add that a number of root causes for the infection should be explored, the user did apparently retrieve it from the trash prior to opening it. That tells me either their spam filter causes a lot of false positives and users are used to checking junk mail for real messages, indicating a systemic problem; junk email show up in their inbox and is just flagged, another systemic problem; or, the user really wasn't trained on why email goes to buck and what to do if th
Re: (Score:3)
Yes, they should have kept the token seeds secure (Score:2)
I DO fault RSA for not compartmentalizing their security. A compromise of a user desktop should be expected. The fact that this foothold let someone get to the token seeds suggests some serious design and procedural negligence on RSA's part. The damage should have been limited to some emails getting leaked, not a compromise of their most vital secrets.
I can believe it (Score:3)
I thought macro viruses were dead? (Score:2)
How do you own someone with an XLS file nowadays?!
(I'm assuming, "How dangerous can it be? It's not an executable!" is exactly what the hapless employee who opened it was thinking too...)
Re: (Score:2)
Having now read TFA (always a good policy), it looks like a Flash exploit was involved. Maybe the Flash applet was embedded using OLE?
Re: (Score:3)
It wasn't a macro, it was an embedded Adobe Flash object.
Re: (Score:3)
So it wasn't just a ball of mud, it was a ball of mud with a nugget of shit in the middle?
Re: (Score:2)
Accessing the FSO (File System Object) is childs play. I can read, write and delete anything I have access to on the network.
It's that easy. Still.
And then there's the Window APIs I can access through VBA...
And I'm pretty poor at doing this stuff (but better than 99% of the office workers)
Re: (Score:2)
Re: (Score:2)
Flash Embedded in Excel? (Score:4, Insightful)
Re:Flash Embedded in Excel? (Score:5, Interesting)
Indeed, there should be a strict separation between documents (things you merely view and possibly edit) and programs (things which do something). Unfortunately that line has been crossed by about every document format, from office files (Word, Excel, ...) over HTML (JavaScript) to PDF.
There should be a set of standard document formats which are guaranteed to not contain any executable code whatsoever, so except for possibly exploiting buffer overflows in interpreting code, displaying the documents is safe. It should be impossible by specification to insert any "active content", i.e. programs, in such documents.
Re: (Score:2)
Dude, once a stream is being parsed, you are always screwed. There will always be a security hole.
Doesn't matter if the 'executable' code is essentially in the document; or the document itself, running against a parser.
They're really the same thing.
Re: (Score:2)
On the other hand, binary file formats that disguise untrusted data as a C struct makes things worse, as C is an unsafe language that for example sliently truncate on integer overflow.
continuum (Score:2)
It was an exaggeration, there are text editors for VMS that haven't required a bug fix in decades. There is almost no chance that between its maturity and simplicity that it still has security holes. However his point is that its not a black and white problem of executable or not executable. Writing a secure text editor is easier than writing a secure word processor, media codecs are not parsing executable files by intent, but there have been holes in them anyway. Its a continuum of increasing complexit
Re: (Score:2)
It comes back to the Von Neumann model of computation which pretty much all modern computers use. Both data and executable instructions are loaded into memory. Once in memory both are just a sequence of 1s and 0s and appear the same to the CPU. It has no way of telling that a particular section of memory is executable and another is not.
If your "data" 1s and 0s just so happen to match the machine code and you get an instruction pointer to jump to where that data is in memory then you're now executing "stati
Re: (Score:2)
Much of the success of Apple, object-oriented systems in general, and later NeXT and the World Wide Web (which was inspired by the NeXT on Berners-Lee's desk), was due to the ability to support 'rich' documents. Back in 1989 being able to send an audio or video file to an associate as part of an email, or incorporate as a natural part of a shared document, was pretty much the 'killer app' for the NeXT. So this raises the question, "How do we define 'executable' in this context?"
For example, a video might
Re: (Score:2)
Or we could just provide a "security" mode. MS Office just makes a feature that says "no macros or flash of any kind in anything that gets opened". They may already have it, but it is hidden in a dialog box that takes twelve clicks to get to, and will be moved to a different location once Office 2011.5 comes out.Anyway, my big innovation is (wait for it)...
Put it on the ribbon.
That's right! Don't hide the "prevent me from fucking over the entire company because i don't need a motherfucking punch the monkey
Re: (Score:2)
There aren't just two buckets (documents and programs). There is an entire spectrum that starts with documents (what I'd call declarative knowledge) and ends with programs (imperative knowledge). In between are things like SQL and Regular Expressions and so forth. The middle of that spectrum is actually pretty interesting because you start to gain a lot of funct
Re: (Score:2)
Well... there's ASCII.
Re: (Score:2)
And as an engineer, I would say: because it shares a code base with other Microsoft products. But that does not make it less wrong. And the problem is two fold: why does it support it at all, widening the attack surface, and why does allow Excel, and then the OS that it compromises security in such a way. IMHO, talking security is about talking "security layers", and both at RSA and with current operating environments, the layers allow for too much to slip by.
Re: (Score:2)
It's not that it supports embedded Flash, it's that it supports embedded COM objects, which includes OLE and ActiveX. Now, if you you're including embedded Word documents, charts, images and equations, it's great. If you want to write your own custom control for your own purposes, that might also be useful! It also means that you can embed Flash and Media Player as a side-effect.
The downside is that Excel (and any other program that can embed such objects in their files) can be used to exploit bugs in an
Suspicious claim by F-Secure (Score:3)
So an anti-virus company, always on the lookup for free publicity, claims that it has come what might have been the e-mail that took down the RSA.
And this makes the news?
In case you hadn't noticed, the anti-virus companies will claim anything to get noticed these days.
Re: (Score:2)
AV products are a loosing battle. If you have to get shot first
Moral of the story.... (Score:5, Insightful)
If you use a commodity OS inside your secure network. you will get hacked and you will get it knocked over.
If you have a high security network and run windows and office on it, it's not high security anymore.
you run apps and Operating systems rated for the security that are tightened down. only a moron would let someone edit a spreadsheet on a PC that is connected to the secure network. You flip to the insecure network machine for tasks like that. No connections between them other than the eyeballs and fingers of the user.
Secure but useless (Score:2)
There are spreadsheets that contain data that the company needs to be kept secure. If the argument is that they should be in gnumeric or open office that's one thing, but even they have scripting languages in them. Furthermore there is source that needs to be written and compiled and tested in secure environments. Simply denying the user all access to executable languages is not an option for some secure systems. Even denying physical access is probably not possible in some test labs. What fits for NOR
Re: (Score:2)
Linux? I'm talking hardened BSD running X.
and no there isn't ask the military. They have already dealt with this. at NORAD each workstation has two PC's and you switch between a secure and a insecure. you as the user have ZERO physical access to the secure box, it's actually in a locked box bolted to the desk.
If hapless employees are your problem... (Score:2)
All you need to do is provide a hap to every employee on their first day of work. Then, later just have an annual hap screening to make sure everyone still has one. Haps can be expensive, but the cost of employees being hapless is much higher.
To extend this principal out a bit (Score:2)
Every New Hire Pack should have the following to be given to the New Hire
1 a current employee handbook (in a readable language)
2 a Hap
3 a Round Tuit
4 a Clue
5 whatever else is normally provided
6 that stack of paperwork that various departments need for a New Hire
RSA uses a free security service? (Score:2)
I am intrigued that RSA forwards their emails to a free virus scanning service. I should going to start my own service. Any company with highly sensitive information is welcome to send it all to me. Don't worry though: we have a posted privacy policy somewhere on our web site.
Ooh, even better idea! How about sending all your passwords to my free service too, and I'll let you know if any of them are insecure!
stupid insider (Score:2)
I used to work for one of the world's leading sporting goods companies. We had contractors onsite with the same network/desktop configuration and access as full time employees. At least one of these outsourced but in-house contractors was stupid enough to fall for pretty much any phishing/fake anti-virus/whatever scheme you can come up with. I have no doubt that any company in the US (what does that mean any more, anyway?) could be compromised given enough persistence and relentless effort to find THAT GUY.
Re: (Score:3)
That said, most companies think convenience > security.
Re:All it takes (Score:5, Insightful)
Being the most secure company on earth is awesome until you go out of business because nobody could get any work done and make the company any money.
There is a balance between convenience and security.
Re:All it takes (Score:5, Insightful)
There is a balance between convenience and security.
Of course there is, but given how often these problems are happening as of late, it seems clear that very few of these companies are finding that balance. One would think the inconvenience of higher security would pale in comparison to the inconvenience of rebuilding your reputation after the entire world watches your organization get brought to it's knees, or lose copious amounts of proprietary data, due to ridiculous things like phishing expeditions.
Re:All it takes (Score:5, Insightful)
Well, that's an interesting question: how much business *does* a company actually lose by being embarrassed in an event like this? Companies keep getting hacked (Citigroup, Sony, TJmaxx, RSA), but they don't seem to be going out of business because of it, or even taking that much of a financial hit...so I'm beginning to suspect that there isn't that much impact after all.
So, if there's no real financial impact aside from PR and cleanup, why should they bother being secure?
Re: (Score:2)
Sony perhaps got a rougher ride than most, and quite possibly did lose a fair chunk of change, but they're still in business, along with Citi, TJ Maxx etc.
Re: (Score:2)
Re: (Score:2)
Most assuredly, there is a balance. It's been said many times, that if you're really concerned about security, you won't ever connect your machine to the internet.
But, when people are connected, they should be AWARE that they are in an insecure environment. Sounds like these security contractors failed to educate their employees, not to mention that they failed to properly secure their networks. Reading an email from Joe Random Stranger is certainly not in any security protocols that I have ever heard of
Re: (Score:2)
Read/write and executable insanity (Score:2)
Re: (Score:2)
If your security fails and you embarrass/endanger your customers or expose your secrets to your competition you go out of business
You didn't really pay attention after all the Sony hacks etc this year, did you?
Re: (Score:2)
Re: (Score:2)
Damaged in who's eyes? Slashdot's? There have been seemingly hundreds of data breaches in the news this year, and while the Sony one is the biggest, I don't think most people have been that bothered. I was a little appalled, but the only thing I had to do was phone my bank and ask for a new credit card, which took 60 seconds.
Re: (Score:2)
Oh, I don't know about that. I've certainly seen the phrase "I'll never buy a Sony product again!" often enough on comment threads and web sites other than Slashdot, but we'll just have to wait and see. The point is, expecting a company like Sony to fold with the same speed a Mom and Pop restaurant does after they infect a bunch of their patrons with Salmonella is silly. 99% of the time it doesn't happen like that, and when it does, that's why it's front page news everywhere.
Even if only a quarter of the
Re: (Score:2)
I'd be very surprised if anywhere near a quarter actually change their buying habits. Also the key word is potential profits, most people who rant on about boycotting companies either don't follow through, or would never have bought from them anyway.
I am sure that even if the entire readership of Slashdot never gave Sony another pound it still wouldn't make a notica
Re: (Score:2)
The point is, expecting a company like Sony to fold with the same speed a Mom and Pop restaurant does after they infect a bunch of their patrons with Salmonella is silly. 99% of the time it doesn't happen like that, and when it does, that's why it's front page news everywhere.
Actually, it's not silly at all. I remember back in the 1990s reading a report by an economics statistician (whose name I've forgotten, of course) who claimed that for the companies for which we have historical records, lifetime and company size have a zero correlation. He used the prototypical "mom-and-pop" corner store as an example, saying that big corporations like General Motors, Pan American World Airways, IBM or Digital are as likely to be gone in N years as that little mom-and-pop that you're thi
Re: (Score:2)
Security is a cost, both in terms of convenience as well as financial...
However the paybacks from security are not obvious, you could make no effort on security whatsoever and still get lucky, or you could make a significant effort and still get hit by sufficiently skilled/determined (or lucky) hackers.
You are right about complexity tho, the more complex you make a system the greater the chance of overlooking something.
Unfortunately, the industry is dominated by large companies that have products to sell,
Re: (Score:2)
> Security is a cost, both in terms of convenience as well as financial...
> However the paybacks from security are not obvious,
Agreed. That's because security prevents _future_ expenses. i.e. Without security you WILL pay for the consequences down the road. With some security you are just delaying the inevitable which may be "good enough."
Interesting to note that both long-term and short term apply: Benefits, Expenses, Convenience, and Costs. Balancing all 4 is not easy.
Re: (Score:2)
In theory. In practice, when the boss tells you to remove a hurdle by giving untrustworthy resources access to a trusted resource, it's bad for job security to say "no because it's bad for corporate security".
Re:All it takes (Score:4, Interesting)
Re: (Score:2)
I'm curious what you propose to do when that doesn't work. Because it won't, unless you've systematically cronied up with the bosses' boss more than the boss has. And I don't see how you could have gotten away with that; a boss won't tolerate that kind of threat to their own authority and autonomy.
The only thing a PHB fears is a subordinate with an effective means to go over his head. And he will do anything necessary to prevent that from happening.
So, going over the boss' head fails. What now?
Houston, we have a problem. (Score:4)
then your boss' boss will know that your boss is unable to manage their team effectively and fire your entire team.
Because that is not a hypotesis but a logically inevitable consequence. Your logic is awesome.
you're an idiot.
Noooo, he's a professional. His job is to escalate and let the chips fall where they may, and in the unlikely chance of getting fired, he goes to get another job. Yeah, yeah, even in this bad economy, that's what you do.
Barring some streneous condition (having a newborn baby or a shitload of medical bills) if someone doesn't escalate things when necessary due to fear of getting fired (an implication of a near complete lack of alternatives) one has to wonder what type of technical value if any such a person has to offer considering that he surrenders his professional duties to that kind of unspoken, on-the-job black-mailing and/or ZOMG! phear of getting hopelessly unemployed.
Re: (Score:2)
Yeah, so you take over jane in Customer Service who then sends an infected e-mail to Bill in the testing unit about a problem with a product once you have the outer network access to elevate to the inside.
Re: (Score:2)
Re:All it takes (Score:5, Insightful)
So why did the non-security support staff have access to the same network the private keys were on? It doesn't just take one careless user, RSA should know about defense in depth.
Re:All it takes (Score:5, Insightful)
Now, as for the broader question of why RSA retained the seed keys for a nontrivial slice of the US's more security-touchy corporations in any remotely online-accessible form, or why those customers accepted that arrangement... There are not words enough to condemn that level of folly.
Re: (Score:2)
The most important question is the bit about "why those customers accepted that arrangement"... And the problem is that quite often, people who understand the technology have no say in the procurement decisions.
Re: (Score:2)
The rule is pretty simple: any attack that can be done by an outsider, can be done by an insider. If they had had defences against a bent user of that account, this would probably not have happened.
Re: (Score:3, Interesting)
You would love to read "The Cuckoo's Egg" by Cliff Stoll. A lengthy but very interesting read.
http://en.wikipedia.org/wiki/The_Cuckoo's_Egg_(book) [wikipedia.org]
Re:All it takes (Score:5, Interesting)
Re: (Score:2)
There is a a very subtle but important difference between security and compliance.
Re: (Score:2)
Subtle? Compliance is about doing things by the book, Security is about picking what book to read. They're completely different things. But you're right that the confusion between them is the root cause for many accidents.
Fun example: I always have to laugh when my compliant screensaver tells me inane things like "never open emails from people you don't know". I wonder how HR will recruit people when they aren't allowed to open the mails from potential candidates :) (hmmm or is this the reason so few people
Re: (Score:2)
I've found they're usually entirely different.
Re: (Score:2)
It's unlikely that they were supposed to have access, but never believe what software vendors tell you about access control...
Most networks are entirely dependent on perimeter security, and are wide open inside... I'm talking unpatched boxes, weak/blank passwords, poor permissions, common or shared passwords and a multitude of other problems.
Once you have access behind the firewall, even comparatively minimal access, its extremely easy to gain access to other devices.
Speaking from experience, having conduct
Re: (Score:2)
The key here is to firewall off different parts of the organization from other parts. The HR department does not need access to the development network, etc. They should be on different domain controllers with different domain admins entirely. Attempts to probe the network from the inside should be monitored and investigated by IT. This is very difficult on a publicly accessible internet server as there are 10s of thousands of bot attacks in a day, but should be doable inside the network. This takes a
Re: (Score:2)
You are paraphrasing the last line of the article. And it isn't like everyone working on computer security isn't well aware, especially a company that sells a product designed to mitigate user silliness like lousy password.
What is more striking to me is that a bug in some minor piece of convenience software is enough, despite efforts at sandboxing and UAC type prompts and ACLs and firewalls and sniffing and all that, to eventually compromise the most important asset a RSA had.
Re:All it takes (Score:4, Insightful)
By analogy, this is part of the reason why high security buildings around Washington DC have no windows. Too easy to 'peek' through (using some arbitrary 'peaking' technology), or break in through.
Most normal buildings are only *apparently* secure, since a simple lock pick or broken window gets you in. I think this phishing attack is analogous to the classic Hollywood entry using a glass cutter and shorting across the alarm wiring. This gets you in the building so you can do your dirty work.
Those high security buildings also sometimes have Faraday cages and other systems built into the structure, but that's another story.
Re: (Score:2)
Nonsense. It takes institution wide use of an operating system with systemic security issues. It take a network where a secretaries computer effectively has access to files relating to defence contractors. It takes a tinderbox network, pre-doused in gasoline in order for one tiny spark to ignite such an inferno.
An international military security verifcation network, compromised by a single flash file in an Excel sheet, opened on a secretaries computer; And it's the secretaries fault? Give
Re: (Score:2)
Re: (Score:2)
You seem to forget the part where this was only the initial attack vector. That's how they got in the front door. It doesn't say how they got into the basement.
Re: (Score:3)
Shit is not going to stop, so all we can do is react and repair. However, when someone has a specific amount of access, perhaps a security policy and/or security training/certificate are required which would include legal or financial punishment to their lax attention.
Re: (Score:2)
Well, some people need to be burned a few times before learning. And there's new schemes every day. Multiplied by the planet's population.
A couple centillion times should do it.
Re: (Score:2)
Or we can start expecting the people who have chosen to specialize their careers in preventing this type of thing, to ensure that a spreadsheet cannot exploit a bug in animation software to gain root access to the entire network.
Cost accounting may prevent either solution from being possible, who knows.
Re: (Score:2)
And as such, we need to start expecting people to have basic computer literacy skills so they do not fall prey to such schemes. How many thousands upon thousands of times does it have to happen before people learn?
Hear, Hear! I can't tell you how many secretaries and mailroom minions I've had to fire because they couldn't detect zero-day vulnerability exploits!
Re: (Score:2)
Or companies need to start implementing defence in depth strategies, rather than concentrating purely on border security.
Virtually every network i've seen has been based around the idea of a firewall separating it from the outside and virtually no security inside the network, or relying entirely on something like active directory access controls and not for a second considering how easy it is to subvert the whole thing.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Bullshit.
Apple was/is the largest mobile target if you include iPod Touches, > 200M devices running iOS. If not, it's a close second to Android.
Stil has an order of magnitude fewer attacks than Android. So biggest target != most attacks. Least secure == most attacks.
Re: (Score:2)
No, I was invalidating your point which was largest == most hit. In actuality, it's most insecure == most hit.
Re: (Score:2)
That doesn't answer why iOS, with more total users, isn't hit more than Android.
Re: (Score:2)
You're smart enough to understand that some systems are designed better than others. Just because it isn't the biggest target doesn't mean it's secure only via obscurity.
Re: (Score:2)
Well, I won't argue that a large chunk of the holes we find in MS are found because they are the big target. That said, even if they weren't the holes would still be there. I'm just saying the two really aren't connected (in that fashion) despite the arguments people like to toss about claiming such.
MS is vulnerable. Period. (Score:4, Interesting)
MS is vulnerable because its the biggest target out there.
While it's true that few people would try to exploit a system nobody uses, MS does its share of the effort to become insecure.
In this specific case, the first breach was done by a Flash program embedded in an Excel spreadsheet. We are going waaay back to all that DDE/COM/OLE/ActiveX thing that has been opening so many backdoors in Microsoft systems for the last decades. Broken by design.
Re: (Score:2)
I didn't even know they had made such a stupid thing possible. I'm starting to understand now why malware is far more prevalent than it was earlier despite a decade of MS pretending to focus on security. The best programmers available can't help when stupid choices are made by well connected inbred idiots with MBAs in shouting.
Re: (Score:2)
Re: (Score:2)
I don't know...to prove that God doesn't exist?
*POOF!*
Re: (Score:2)
There is no such thing as "secure" software because anyone who speaks of "security" as an absolute is a fool (this applies in things other than softare, by the way). There is, however, software that is more secure and software that is less secure.
Re: (Score:3)
If your mail admin (or outsourced mail provider) allows inbound messages that are spoofing your company's domain(s), they are worthless and have no business running your mail system.
Re: (Score:2)
They could have spoofed a vendor's domain (didn't read the article). How could their mail server detect that unless there are some very strict SPF in place for that domain?
Re: (Score:2)
Re: (Score:2)
No admin privileges needed - once you're running on the OS you can exploit numerous bugs to elevate your privileges but perhaps they didn't even need that. Just having access to all of the user-files would be pretty usefull in and off itself.
I've been bitten by that one before when I read a tweet that opened up javascript that opened a PDF that had embedded scripting that executed and closed. The next day I got a call from my hosting provider that my FTP-accounts had been closed due to suspicious activities