Scourge · March 17 2011

The Scourge of the Betrayed Token

Chronicle

On 17 March 2011 RSA's executive chairman, Art Coviello, disclosed in an open letter an intrusion described as an "advanced persistent threat", which had stolen information related to its SecurID two-factor tokens. The attackers got in through phishing emails titled '2011 Recruitment Plan' carrying an Excel file with a Flash zero-day. The stolen data was later linked to an attempted attack on Lockheed Martin, and RSA offered to replace customers' tokens.

Lesson learned

It was a reminder that security vendors can be breached too, and that a second factor is only as good as the secrets its maker keeps.

Prayer of reparation

O SecurID, whose numbers changed every minute while their seeds sat still in an archive, protect the keys of the keymakers. Amen.

How it is remembered

Remembered by opening unexpected attachments in a sandbox, updating or removing plugins and preferring phishing-resistant authentication.