RSA security lapse led to March hack, says researcher
Exploit targeted Windows XP machines that didn't have DEP switched on
Computerworld - The attack that hacked RSA Security's network earlier this year succeeded because the company failed to take a basic security precaution, a researcher said Monday.
According to Rodrigo Branco, the director of Qualys' vulnerability and malware research labs, the malware targeted the decade-old Windows XP.
"The feeling is the target[ed PC] was running Windows XP SP3 ... with all the patches," said Branco in emailed answers to questions.
The problem, said Branco, is that while Windows XP includes the DEP (data execution prevention) defensive technology -- Microsoft added DEP to XP in 2004 with Service Pack 2 -- it's not switched on by default.
And RSA apparently neglected to turn it on.
Branco based his bet on his investigation into the exploit code that RSA confirmed had been used to break into its network.
That code exploited a then-unpatched vulnerability in Adobe Flash Player -- Adobe quashed the bug Mach 21, four days after RSA acknowledged the attack -- and followed by infecting the target PC with a customized variant of the Poison Ivy remote administration tool (RAT).
Branco eliminated Windows Vista and Windows 7 from the list of targeted operating systems because both enable DEP by default. DEP would have stymied the exploit from executing, he said.
Additionally, the exploit code would not execute on a Windows 7 PC because of changes to the kernel in that edition.
Targeting Windows XP is still a popular pastime for hackers. The "Aurora" campaign that breached Google's network -- and led it to threaten to pull its operations from the People's Republic of China -- and dozens of other Western companies also aimed to subvert Windows XP systems.
Branco believes that the RSA attackers either pegged the security firm as running Windows XP or simply assumed that the company, like many others, still relied on the aged operating system.
"This isn't difficult information to get from companies," said Branco. "Programs like browsers leak this information all the time."
There is an outside chance that the RSA attack did compromise a Windows Vista or Windows 7 machine, Branco said, noting that his research showed the exploit could have been modified to execute on those versions.
But he ultimately rejected that possibility.
"I don't think it was [modified to work on Vista or Windows 7], because apparently the exploit was re-used as is," Branco said, referring to the Flash exploit tucked into an Excel spreadsheet, the identified infection vector for the attack.
RSA could have prevented the expensive breach -- it spent $66 million replacing customers' SecurID tokens -- by either migrating its Windows XP machines to a newer OS, by isolating those XP PCs, or by enabling DEP on them, Branco concluded.
Microsoft implicitly agreed last spring when it said that the Excel-based attack could not have worked on PCs running Office 2010, which automatically enables DEP.
Microsoft also published a security advisory shortly after RSA confirmed the attack, telling users that they could protect their PCs by switching on DEP in older versions of Office using the Enhanced Mitigation Experience Toolkit (EMET).
Instructions for switching on DEP in Windows XP SP2 and SP3 are available on Microsoft's website.
Researchers suspect that the RSA attack originated in China, based on the location of the malware's command-and-control (C&C) servers and other evidence.
RSA declined to comment on the specific version of Windows that the company was running at the time of the attack and said it would also not comment on details of Branco's research.
A spokesman, however, did say that the company "is generally supportive of this kind of analysis as it can help organizations in their understanding of how advanced threats are carried out so they can better detect and defend against them."
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts