Cyber attack on security firm exposes Westpac, other Aussie firms
Reports of "an extremely sophisticated cyber-attack," on data security specialist RSA may have exposed many Australian firms being served by the security company and chief among them was Westpac, according to a tech report published by SmartHouse.
The report said on Tuesday that thousands of Westpac consumers may have been exposed to considerable risk due to the breach as the giant bank facilitates bank transfers with the use of RSA security token.
A subsidiary of global data storage giant EMC, RSA specialises in the use of security tokens that creates digital security codes that automatically alter every 60 seconds and is normally deployed with a static password to gain entry in a computer system.
Westpac has yet to issue a statement that would approximate the extent of the damages caused by the hacking attempt while on its part, RSA declined to provide details on how its security was attacked and the specific threats that its clients now face.
However, the company's official website currently carries a statement, in which it admitted that the cyber attack "resulted in certain information being extracted from RSA's systems ... which was specifically related to RSA's SecurID two-factor authentication products."
While RSA claims on its site that its SecurID system has been impregnable for the past 15 years, its statement on the security breach pointed to the possible reduced effectiveness "of a current two-factor authentication implementation as part of a broader attack."
Security experts said that the mostly likely target by hackers could be the RSA-installed key, known as seed, which usually is a 16-character token checked and verified during access to a secure network.
The SmartHouse report explained that in the event of an intruder breaching the seed's database, the hacker may not be able to pinpoint of any usable seed but cryptographers maintained that "it would be possible to use a reverse-engineered version of the RSA algorithm to determine that information by simply capturing a single log-in session."
Aside from Westpac, RSA counts Telstra Corporation and Virgin Blue Holdings as among its top corporate clients in Australia while the federal offices of the Prime Minister, Treasury, Defense and other major government agencies also use the services of the security firm.