A well-crafted message tricked an RSA employee into opening a phishing email that launched a sophisticated attack on the company's information systems. And a list of big-name corporations and brands affected by the epsilon email breach, TOPS100. Hi, I'm Tracey Kidn with Information Security Media Group, here with the Editor's Choice for the month of April. A well-crafted email with the Subject Line 2011 recruitment plan tricked an RSA employee into opening a malicious email that led to a sophisticated attack on the company's information systems.
An Excel spreadsheet attached to the phishing email contained a zero-day exploit that led to the installation of a backdoor virus that exploited an Adobe Flash vulnerability, which Adobe has since patched. RSA on March 17 revealed that an attacker targeted its secure ID, two-factor authentication product, and what it termed an advanced persistent threat breach, a sophisticated and clandestine means to gain continual persistent intelligence on a group, such as a nation or corporation. An analysis of the breach determined that the attacker sent two different phishing emails over a two-day period to two small groups of RSA employees. Once inside, the attacker sought out employees with greater access to sensitive information.
RSA says the attacker initially harvested access credentials from the compromised employee and performed privilege escalation on non-administrative users in the targeted systems, and then moved on to gain access to higher-value targets, which included process experts, as well as IT and non-IT server administrators. Epsilon, an online marketing unit of Alliance Data Systems Corporation, announced on April 1 that an outside intrusion had hacked into some of its customer files. Epsilon sends email campaigns and offers to consumers who register for a company's website, or who give their email address as well-shopping. Epsilon sends more than 40 billion emails annually, and also runs loyalty programs for city and chase credit card users.
The list of companies and brands affected by the Epsilon breach continues to grow. As of April 18, 112 companies and brands had reportedly been hit. Epsilon's database is how consumer information cyber criminals could use for targeted phishing attacks better known as spear phishing, but experts say banks and retailers are doing all they can to control consumer concerns in the aftermath of the breach. Communicating with consumers about the incident and warning them not to click links in phishing emails are all institutions and companies really can do, says Jeremiah Grossman, Chief Technology Officer of White Hat Security.
Financial institutions should be moving down the path of authenticating transactions, such as back and fraud monitoring, rather than authenticating the identity of a person. Financial institutions should assume the customer's computer or account is compromised and implement ways to continue business. We wrap up the month with a payments fraud update from banking regulator Gigi Highland, who says expected changes to the FFIAC's online authentication guidance could be released any day. Highland, a board member of the National Credit Union Administration, says ACH fraud and online cyber attacks are escalating, and credit unions and other financial institutions must do as much as they can to ensure appropriate internal controls are put in place to avert the risk of fraud.
Here is Gigi Highland. It's really meant to be an update, a supplement to reinforce the 2005 guidance that was offered in terms of the risk management framework that was provided back in 2005, and I think to also update the FFIAC agency's expectations regarding customer authentication and layered security and other controls to effectively control and mitigate the risk posed not only by fraudsters, but also by cyber criminals. So I think it will be an important update, again, given the dynamic fluidity of the change in this area and trying to keep up essentially with all of the cyber security threats that are posed to financial institutions. That's the Editor's Choice for the Month of April.
For Information Security Media Group, I'm Tracy Kid. Have a great month.