<story><title>The full story of the RSA hack can finally be told</title><url>https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/</url></story><parent_chain></parent_chain><comment><author>NelsonMinar</author><text>This story was big news when it happened and I&amp;#x27;m grateful to Andy Greenberg for writing this retrospective. Pretty much nothing has changed about security at companies in the last ten years that would foil this kind of attack. I mean maybe folks are a little smarter about catching spearfishing Office docs, and Flash exploits are now a thing of the past, but those are replaced by contemporary equivalents. And I&amp;#x27;m sure conveniences like the not-quite-airgapped crucial equipment still persist. We truly have no idea how to secure systems on the Internet.&lt;p&gt;As for RSA, it came out a couple years later their products were compromised various ways by the NSA. Then a couple years later the NSA lost control of its own hacking tools with the infamous Shadow Brokers release. Not only is building secure systems hard, but the US government actively works to undermine its own companies&amp;#x27; security.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reuters.com&amp;#x2F;article&amp;#x2F;idUSBRE9BJ1C220131220?irpc=932&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reuters.com&amp;#x2F;article&amp;#x2F;idUSBRE9BJ1C220131220?irpc=9...&lt;/a&gt;
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2014&amp;#x2F;01&amp;#x2F;how-the-nsa-may-have-put-a-backdoor-in-rsas-cryptography-a-technical-primer&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2014&amp;#x2F;01&amp;#x2F;how-t...&lt;/a&gt;</text></comment>
<story><title>The full story of the RSA hack can finally be told</title><url>https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/</url></story><parent_chain></parent_chain><comment><author>chinathrow</author><text>&amp;gt; RSA executives told me that the part of their network responsible for manufacturing the SecurID hardware tokens was protected by an “air gap”—a total disconnection of computers from any machine that touches the internet. But in fact, Leetham says, one server on RSA’s internet-connected network was linked, through a firewall that allowed no other connections, to the seed warehouse on the manufacturing side.&lt;p&gt;That&amp;#x27;s not really an air gap, isn&amp;#x27;t it?</text></comment>