RSA's Servers Hacked

[Sabre]

/. coverage
The Register

Attackers breached the servers of RSA and stole information that could be used to compromise the security of two-factor authentication tokens used by 40 million employees to access sensitive corporate and government networks, the company said late Thursday.

“Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat (APT),” RSA Executive Chairman Art Coviello said in an undated letter posted on the company's website. “Our investigation also revealed that the attack resulted in certain information being extracted from RSA's systems.”

Neither the letter nor a filing (PDF) with the Securities and Exchange Commission identified what the stolen data was, but Coviello went on to say it “could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.”

Michael Gallant, a spokesman with RSA owner EMC, declined to answer any questions posed by The Register.

Among the unanswered questions was whether attackers got access to the so-called seed values that SecurID tokens use to generate the six-digit numbers that change every 60 seconds. Workers in both private industry and government agencies use the devices as an additional security measure when logging onto their employers' networks. Requiring the employee to have physical access to the dongle thwarts hackers who may have intercepted the users' password.

If attackers were able to access the seeds for a specific company, they might be able to generate the pseudo-random numbers of one of its tokens, allowing them to clear a crucial hurdle in breaching the company's security.

Other possibilities include the theft of source code that gives attackers a blueprint of vulnerabilities to exploit, or the theft of private cryptographic keys that might allow them to imitate RSA servers or register new employee tokens.

“RSA is going to have to convince people that their stuff still works,” said Nick Owen, CEO of Wikid Systems, a two-factor authentication startup that competes with RSA. “That means they'll have to come clean about the attack. They may be in a position where they have to reissue hardware tokens to their users as well.”

Owen noted that RSA's notice came as one of the company's websites related to the activation of software licenses was down for unexplained reasons. It's not clear if the outage is related to the attack.

Coviello's letter said that company security systems recently identified “an extremely sophisticated cyber attack in progress being mounted against RSA.” That description, and the reference to APT, leaves open the possibility that attacks could have lasted days, weeks, or months – but the company didn't say more. They also evoked memories of attacks Google disclosed early last year that breached security at dozens of companies and made off with highly sensitive data.

The vagueness also generated plenty of criticism among security professionals.

“APT: Yeah, we got pwned, leaked all your data,” web app security guru Mike Bailey tweeted, in a mock paraphrase of Coviello's letter. “Srry about that, but this guy was GOOD.”

RSA sent a communication to customers urging them to follow a variety of security best-practices, including to “enforce strong password and pin policies,” to “re-educate employees on the importance of avoiding suspicious emails,” and to “harden, closely monitor, and limit remote and physical access to infrastructure that is hosting critical security software.”

We're hoping a version of the email has been sent to RSA employees and executives as well. ®

Wow could this have some wide spread effects...

[PGT]

ruh-roh

[Mr Kleen]

ruh-roh

[complacent]

it's good not to be on rsa's stuff right now. ahhh...

[PGT]

http://blogs.rsa.com/rivner/anatomy-of-an-attack/

I was on a tour in Asia Pacific when I first heard the news about the attack. The investigation into this attack continues but I’m eager to share some information with you about it.

Let’s first make sure everyone is on the same page. The number of enterprises hit by APTs grows by the month; and the range of APT targets includes just about every industry. Unofficial tallies number dozens of mega corporations attacked; examples are in the press regularly, and some examples are here, and here.

These companies deploy any imaginable combination of state-of-the-art perimeter and end-point security controls, and use all imaginable combinations of security operations and security controls. Yet still the determined attackers find their way in. What does that tell you?

The first thing actors like those behind the APT do is seek publicly available information about specific employees – social media sites are always a favorite. With that in hand they then send that user a Spear Phishing email. Often the email uses target-relevant content; for instance, if you’re in the finance department, it may talk about some advice on regulatory controls.

more here http://blogs.rsa.com/rivner/anatomy-of-an-attack/

[Sabre]

Yes, the APT is a problem for everyone... but this should not be an excuse. I'm sorry, but the stuff that was stolen should have been air gapped from the Internet. This is a HUGE mistake on their part and it will take a very long time for people to trust them again.

[PGT]

yep. like removing root TLDN servers from the network and locking them away in a safe somewhere, inside a SCIF for safekeeping.

[PGT]

http://washingtontechnology.com/Article ... d.aspx?p=1


More cyberattacks reported; RSA tokens likely involved

Two more defense companies reported targeted on heels of Lockheed Martin breach

* By William Jackson
* Jun 01, 2011

Has someone declared a cyber war against government contractors?

Two more cyberattacks, this time against Northrop Grumman Corp. and L-3 Communications Inc., have been reported, barely a week after an attack on Lockheed Martin Corp. caused the shutdown of some of its systems.

The attacks apparently are the fallout from a breach at EMC Corp.’s RSA Security division earlier this year, where information is believed to have been taken and used to attack Lockheed Martin Corp. and L-3.

The L-3 attack was reported May 27 by Reuters, which said attackers reportedly were able to spoof the passcode from an RSA SecurID token.

Fox News is reporting the attack on Northrop Grumman, but the company has declined to confirm the breach.

Similar data is believed to have been used in a May 21 attempt to access Lockheed Martin, which the company described as a “significant and tenacious attack on its information systems network.”

The RSA breach, reported in March, was described by the company as an Advanced Persistent Threat that targeted information related to the SecurID two-factor authentication product. Although details of that attack still have not been released, it is believed that information about the seed numbers used by an algorithm to generate one-time passcodes on the token was taken.

In a letter to customers, RSA Executive Chairman Art Coviello said that, although “the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.”

The broader attack appears to be what has happened at Lockheed Martin and L-3, according to observers in the industry.

Harry Sverdlove, CTO at Bit9, an end-point security company, said the Lockheed Martin attack apparently began with the compromise and installation of keylogger malware on a computer that remotely connected to the corporation’s network. That would let the attacker collect a log-in password and probably several one-time SecurID passcodes.

The passcodes cannot be reused and by themselves are useless. Likewise, the algorithm used to generate them is well-known, but is useless without a seed number that is used to determine what codes are generated. But if the attacker had access to several passcodes, it would be a trivial task to work through a database of seed numbers to determine which value was used to create the codes, Sverdlove said. The attacker could then use that value to generate viable passcodes that could be used with the password to log into the system.

“Whoever attacked Lockheed Martin was the same as who attacked RSA or had access to information from the RSA breach,” Sverdlove said.

He said the exploit that delivered the keylogger to the remote computer likely came through a targeted phishing e-mail, the same technique that was used in the initial RSA attack and that also was used to break into systems at the Oak Ridge National Laboratory in April. The series of attacks illustrates how vulnerable the most sophisticated defenses can be to a well-engineered phishing attack.

“It only took one infiltration vector to steal everything needed to defeat two-factor authentication,” Sverdlove said.

The attackers are not “one-trick ponies,” Sverdlove said. “They are raising the bar,” by building on initial successes to develop additional attacks.

Sverdlove said that “hardening” passwords used with two-factor authentication or using additional passwords provides no additional security in a system that has been compromised, because attackers are able to collect password data.

Ronald Rivest, professor of computer science at the Massachusetts Institute of Technology and originally the “R” in RSA, said there is no end in sight in the battle between attackers and defenders.

“It is not a problem you can solve,” Rivest said. “We will continue to see attacks and we will continue to see successful attacks.”

He compared cybersecurity to health care, in which new drugs and treatments are continually developed to improve health, although new germs and diseases continue to appear. Success is not determined by the ability to completely eliminate problems.

“There is no silver bullet,” Rivest said. “We must aim for steady progress, not perfection.”

[Sabre]

Ars - RSA finally comes clean: SecurID is compromised

RSA Security will replace virtually every one of the 40 million SecurID tokens currently in use as a result of the hacking attack the company disclosed back in March. The EMC subsidiary issued a letter to customers acknowledging that SecurID failed to protect defense contractor Lockheed Martin, which last month reported a hack attempt.

SecurID tokens are used in two-factor authentication systems. Each user account is linked to a token, and each token generates a pseudo-random number that changes periodically, typically every 30 or 60 seconds. To log in, the user enters a username, password, and the number shown on their token. The authentication server knows what number a particular token should be showing, and so uses this number to prove that the user is in possession of their token.

The exact sequence of numbers that a token generates is determined by a secret RSA-developed algorithm, and a seed value used to initialize the token. Each token has a different seed, and it's this seed that is linked to each user account. If the algorithm and seed are disclosed, the token itself becomes worthless; the numbers can be calculated in just the same way that the authentication server calculates them.

This admission puts paid to RSA's initial claims that the hack would not allow any "direct attack" on SecurID tokens; wholesale replacement of the tokens can only mean that the tokens currently in the wild do not offer the security that they are supposed to. Sources close to RSA tell Ars that the March breach did indeed result in seeds being compromised. The algorithm is already public knowledge.

As a result, SecurID offered no defense against the hackers that broke into RSA in March. For those hackers, SecurID was rendered equivalent to basic password authentication, with all the vulnerability to keyloggers and password reuse that entails.

Well, I guess that makes it official! That is going to be a costly problem, that is for sure.

[complacent]

Well, I guess that makes it official! That is going to be a costly problem, that is for sure.

what i had mistaken for thunder was actually the mass feinting of project managers all over the country.