Comment by GBond | Hacker News Reader

Comment by GBond | Hacker News Reader

Parent Full thread

> So, was this an Advanced attack? The email wasn't advanced. The backdoor they dropped wasn't advanced. But he exploit was advanced. And the ultimate target of the attacker was advanced. If somebody hacks a security vendor just to gain access to their customers systems, we'd say the attack is advanced, even if some of the interim steps weren't very complicated.

The whole post read to me as "meh. We haz hack for months. not impressed".

But they neglected to mention the most sophisticated hacks of the whole incident:

1. cracked the vault/SCM of where the SecrueID token generation algo (generates a pseudo-random number) is stored

2. reverse engineered the SecureId token (ok, not that hard as apparently the crypto allowed regeneration the seed and associated token but still more sophisticated then a Excel/flash exploit)

The whole Excel/Flash exploit was just to get through the patio screen door (equates to the same access an employee has). What was more serious and not mentioned was the attackers cracked the safe in the house.

Disclosure: I work at EMC.

It's sad to see that the most detail of the attack we employees of EMC have seen comes from an outside source. The infiltration clearly began by targeting EMC employee(s) not RSA. It's been many months since the attack with nothing being told to the employees whatsoever. I've even heard additional stories about other attempts at social engineering to gain more information recently.

I'll answer questions that I can if anyone is interested but as mentioned above, we really aren't informed ourselves.

To address your first point: I was under the impression seeds were stored for most(all?) customers for "bakcup" purposes. These were taken and matched against SecureID serials for use in more social engineering attacks (getting the other part of the two-factor auth).

Are they still storing 'backup' seeds? Because to me, that sounds like a pretty huge target at this point.

I cannot say for a certainty that they aren't as I'm not privy to that information. I'd hope with the new tokens released the backup of the information should rely on the owners infrastructure. RSA has been put on a secluded network away from EMC network.

Is there a description somewhere that talks about points 1 and 2 in greater detail?

I was reading the article waiting for something about that too. It's a shame all it mentioned was that the hackers used a relic of a RAT (Poison Ivy) in combination with a spreadsheet + flash object.

Agreed. One could argue that the post/title is totally linkbait. Plus they have a GIANT pic of the SecureID key fob but the content has nothing to do with it being cracked.

Forgive my ignorance but isn't the hash algorithm publicly known? Isn't "reverse engineered the SecurID token" basically have the same meaning as breaking RSA algorithm?

Reply on news.ycombinator.com