The RSA SecurID hack of 2011: one spreadsheet from the junk folder

The company whose key-fob tokens guarded logins at banks, governments and defense contractors was breached in 2011 through a spreadsheet an employee fished out of the junk mail folder.^[1] This case file covers how that one email led to stolen SecurID information, why a defense contractor said it paid the price, and the one control that would have kept the crown jewels out of reach.

What happened

How they got in

The spreadsheet carried a hidden object that took advantage of a flaw in Adobe Flash that had not yet been fixed, a so-called zero-day, later catalogued as CVE-2011-0609.^[1][3] Opening the file quietly installed a backdoor that gave the intruders remote control of the employee's computer.^[1]

From that first foothold, the attackers went after more powerful accounts. They collected login details, worked their way up to administrator-level access, and gathered the data they wanted on internal servers before sending it out of the company in compressed, encrypted bundles.^[1]

The hard part for RSA was what sat within reach. Press reports at the time raised the worry that the stolen material could include the secret seed values that make each token's numbers unique, or the records linking tokens to those seeds.^[1] Anyone holding that information would be much closer to faking a token's code, which is exactly what the product was meant to prevent.

What it cost

The breach turned into a customer crisis. In an open letter, RSA's executive chairman, Art Coviello, said the attackers had been after security information to target the defense sector, not money or personal data.^[2] After the Lockheed news, RSA offered to replace tokens for virtually every customer, with a focus on organizations protecting intellectual property, and offered extra fraud monitoring to banks with large, dispersed customer bases.^[2]

Lockheed said it was replacing 45,000 SecurID tokens used by its employees, and RSA gave 45,000 new tokens to its own staff.^[2] Reports at the time also said other defense contractors had been targeted using stolen SecurID information.^[2] Beyond hardware, the real cost was trust: a product sold as the second lock on the door had to be re-issued because the keys to the lock had been kept too close to everyday email.

The missing control

The missing control: isolating authentication secrets from the corporate network. Information that could help defeat SecurID was reachable from ordinary office systems, the same systems where staff read email and opened attachments.

Phishing will always get through sometimes; here, even the junk filter could not save the day once a person rescued the message.^[1] The damage depended on what the intruders could reach next. If the token secrets had lived on a separate, locked-down network with no path from staff workstations, and with tight, logged access for the handful of people who needed them, a single infected laptop would have been a bad week instead of a global token recall.

What to do in your business

• Name your crown jewels. Write down the few things that would hurt most if stolen: admin passwords, backup keys, customer databases, banking logins. Know exactly where each one lives.
• Keep them off everyday machines. Store the most sensitive credentials in a password manager or vault with its own strong login, not in files or spreadsheets on the computers used for email and web browsing.
• Use separate admin accounts. People who manage systems should use one account for daily email and a different one, with a second factor, for administrator work.
• Tell staff the junk folder is there for a reason. Make it normal to ask IT before opening anything unexpected, especially attachments from strangers, and never penalize someone for asking.
• Keep software updated automatically. Turn on automatic updates for browsers, office apps and plug-ins, and remove old ones you no longer use so there is less to exploit.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.