Initial Thoughts on RSA "APT" Announcement
Today RSA's Art Coviello announced the following:Recently, our security systems identified an extremely sophisticated cyber attack in progress being mounted against RSA...
Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat (APT).
Our investigation also revealed that the attack resulted in certain information being extracted from RSA's systems. Some of that information is specifically related to RSA's SecurID two-factor authentication products.
While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack...
This is one of the problems with debates over terminology. If we all accepted the actual definition of APT as created by the Air Force in 2006, we would know what Mr Coviello is describing. Without that clarity we're left wondering if he means any threat on the planet that he and RSA choose to describe as "APT."
Without knowing anything more than what is printed in the RSA announcement, I can offer the following opinion. It is not outside the realm of APT methodology and targeting to attack RSA in order to access internal details on their authentication technology. We know APT actors have attacked other technology companies to steal their intellectual property, ranging from software to algorithms to private keys, all to better infiltrate other targets.
As I Tweeted on March 10th, it's public knowledge that validated APT actors have targeted public key infrastructure for several years. Besides PKI, enterprises of all types rely heavily on two-factor systems such as those created by RSA. Stealing technology and examining it for weaknesses, or identifying ways to exploit the supply chain, or otherwise gain an advantage over RSA users are all valid APT interests.
Hopefully we will learn more about this issue as time passes.
Tweet
Comments
http://www.sec.gov/Archives/edgar/data/790070/000119312511070159/dex992.htm
On another note, I surely hope "extremely sophisticated cyber attack" is not the same type of "sophisticated attack" that pierced HBGary.
It's possible this is not a "true APT" as I would define it. It's possible Art used "APT" as cover for an unsophisticated, opportunistic intruder. We just don't know yet. Referencing Matthew's comment, HBG wasn't an APT victim (and never said that), but other victims might just blame "APT" whenever they get compromised. Tough situation.
Mandiant's recent reports on APT did a good job of setting the definition in butter if not stone. There needs to be some effort to ground that definition so that the term is not abused.
That said, the reason the definition has "expanded" from the original 2006 definition--which covered a specific threat actor--is that it is even more useful to describe a CLASS of threats than one single threat.
This is useful from an ops perspective even if it does get some of the intel weenies all wrapped around the axle. For example, I've been around quite a few discussions lately concerning whether or not Stuxnet represents an APT--people who want to stick to the original definition are adamant that it is not, but the threat actor was quite obviously both advanced and persistent.
When you're spitballing planning assumptions and you want to speak to adversary capability and intent, the Stux actor falls into the same CLASS as the more "traditional" APT even if their technique and motivations were radically different. I believe that this take jibes with your January 16th post on the subject (http://taosecurity.blogspot.com/2010/01/what-is-apt-and-what-does-it-want.html).
As for whether or not RSA's case involves an APT--depends on what they took and why. I suppose time will tell.
The good news, he said, is that most enterprises that invest in multifactor authentication are sophisticated enough to always [be, sic] on the lookout for potential intruders.
That's not what I told Rob (the reporter). I told him that the best defense, even if your two-factor fails, is to always be on the lookout for potential intruders.
There is probably no correlation between use of multifactor and the sophistication of the enterprise.
Otherwise, he quoted me fairly well! Thank you.
The danger here of course is that the token-specific random seeds were leaked. If that's the case, all affected tokens would need to be retired from use, IMO.
Reflections on Security
http://www.networkworld.com/news/2011/031811-rsa-breach-reassure.html
So yes, evidence exists to support Richard's reasoning that this intent fits well within the (admittedly now watered down) APT classification.
RSA SecurID Authentication Security