According to a security advisory issued by Adobe, attackers exploited an unpatched bug by “embedding malicious Flash files within a Microsoft Excel document sent as an e-mail attachment”.

It is alleged that the attackers breached RSA’s security and gained access by sending two small groups of RSA employees emails with these spreadsheets attached. The email was then opened by an employee, thereby inadvertently letting the hackers loose into the network.

Wolfgang Kandek, a technology expert, commented on the situation - claiming the hackers probably used Excel files as generally, people don't expect this kind of document to be part of a hacking strategy. He said “hackers use whatever mechanism makes sense, and Excel files are generally trusted documents. So [the Excel document] is just part of the social engineering element here”.
 

Following the incident, RSA published an open letter on its website to customers advising them that the effectiveness of the technology had indeed been compromised in what they said they believed to be an “Advanced Persistent Threat” (APT) to their systems. In the letter, Executive Chairman, Art Coviello, claimed that RSA was “confident that the information extracted [in the breach would] not enable a successful direct attack on any of our RSA SecurID customers”, but went on to warn that the information “could potentially be used to reduce the effectiveness of a current two-factor authentication implementation”.

The fight against cybercrime - how robust is your armour?

Whilst Adobe has since patched Flash and also updated Adobe Reader, and RSA has taken swift steps to reassure its customers that their data is safe, this incident must surely serve to demonstrate that no organisation can rest on its laurels in the fight against cybercrime.

In general the number of malicious attacks continues to grow, and an extract available from last year’s Internet security report reveals these sobering figures: