{
	"id": "3450410b-0738-4938-8415-b5f932d676d2",
	"created_at": "2026-04-06T01:31:45.381612Z",
	"updated_at": "2026-04-10T03:21:04.081177Z",
	"deleted_at": null,
	"sha1_hash": "71af5df95019a80657da88cd39a666dc670e0d2a",
	"title": "RSA confirms its tokens used in Lockheed hack",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 40323,
	"plain_text": "RSA confirms its tokens used in Lockheed hack\r\nBy William Jackson\r\nPublished: 2011-06-07 · Archived: 2026-04-06 00:43:53 UTC\r\nBy William Jackson,\r\nGCN\r\n| June 7, 2011\r\nThe complicated attack might have used log-in data obtained via a phishing attack\r\nalong with algorithm seed numbers taken from RSA to generate new passcodes.\r\nAuthentication\r\nRSA Security has confirmed that stolen data about the company’s SecurID authentication token was used in the\r\nrecent attack against defense contractor Lockheed Martin. RSA has offered to replace the compromised tokens for\r\nhigh-risk customers.\r\nThe RSA breach, reported March 17, was the result of what the company called an “extremely sophisticated”\r\nattack. The company said that it believed the likely motive was to take data that could be used against defense\r\ncontractors rather than against financial institutions or to steal personal information.\r\nArt Coviello, executive chairman of RSA, the Security Division of EMC, wrote in a letter posted after close of\r\nbusiness June 6 that other victims in a recent “unprecedented wave” of cyberattacks, including Epsilon, Sony,\r\nGoogle, PBS and Nintendo, were not related to the RSA breach.\r\nRelated stories:\r\nAfter hack, security of RSA SecurID tokens in the hands of customers\r\nAnother major defense contractor hacked; RSA tokens likely involved\r\n“It is important for customers to understand that the attack on Lockheed Martin does not reflect a new threat or\r\nvulnerability in RSA SecurID technology,” Coviello said in the statement. “Indeed, the fact that the only\r\nconfirmed use to date of the extracted RSA product information involved a major U.S. defense contractor only\r\nreinforces our view on the motive of this attacker.”\r\nThere was no mention in the statement of the recent and similar attack against L-3 Communications, another\r\nmajor defense contractor, which is believed to have leveraged the same kind of data as that used against Lockheed\r\nMartin.\r\nhttps://www.route-fifty.com/cybersecurity/2011/06/rsa-confirms-its-tokens-used-in-lockheed-hack/282818/\r\nPage 1 of 2\n\n“Whoever attacked Lockheed Martin was the same as attacked RSA or had access to information from the RSA\r\nbreach,” said Harry Sverdlove, chief technology officer of Bit9, an end-point security company.\r\nThe initial RSA breach was described by the company as an Advanced Persistent Threat that targeted information\r\nrelated to the SecurID two-factor authentication product.\r\nAlthough details of that attack still have not been released, it is believed that information about the seed numbers\r\nused by an algorithm to generate one-time passcodes on the token was taken. The passcode is used together with a\r\nuser’s log-in ID and personal identification code. Because the system generates a new one-time passcode every 60\r\nseconds, they cannot be reused. The algorithm used to generate the codes is publicly available, but without the\r\nseed number it is not possible to duplicate the passcode sequence.\r\n“Whoever attacked RSA has certain information” about the product, “but not enough to complete a successful\r\nattack without obtaining additional information that is only held by our customers,” the company said at the time\r\nthe breach was reported.\r\nBut if a hacker with access to a list of seed numbers could obtain several passcodes from a token, they could be\r\nused to determine which seed number was being used, which could allow a hacker to spoof a legitimate new\r\npasscode. This, together with other stolen log-in data, could be used to obtain access.\r\nThis apparently is what happened with Lockheed Martin and L-3. Researchers believe that a keystroke logger was\r\nplaced on a computer used for remote log-in, possibly through a spear-phishing attack, and was able to steal a user\r\nID, PIN and several one-time passcodes.\r\nCoviello said the company remains confident in SecurID and that remediation advice offered to customers is\r\nadequate.\r\n“However, we recognize that the increasing frequency and sophistication of cyber attacks generally, and the recent\r\nannouncements by Lockheed Martin, may reduce some customers' overall risk tolerance,” Coviello said in the\r\nstatement. “As a result, we are expanding our security remediation program to reinforce customers' trust in RSA\r\nSecurID tokens and in their overall security posture.”\r\nThe company will replace SecurID tokens for customers “with concentrated user bases typically focused on\r\nprotecting intellectual property and corporate networks.” For consumer-focused customers with larger, more\r\ndispersed user base RSA is offering to implement risk-based authentication strategies to protect Web-based\r\nfinancial transactions.\r\nSource: https://www.route-fifty.com/cybersecurity/2011/06/rsa-confirms-its-tokens-used-in-lockheed-hack/282818/\r\nhttps://www.route-fifty.com/cybersecurity/2011/06/rsa-confirms-its-tokens-used-in-lockheed-hack/282818/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://www.route-fifty.com/cybersecurity/2011/06/rsa-confirms-its-tokens-used-in-lockheed-hack/282818/"
	],
	"report_names": [
		"282818"
	],
	"threat_actors": [],
	"ts_created_at": 1775439105,
	"ts_updated_at": 1775791264,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/71af5df95019a80657da88cd39a666dc670e0d2a.pdf",
		"text": "https://archive.orkl.eu/71af5df95019a80657da88cd39a666dc670e0d2a.txt",
		"img": "https://archive.orkl.eu/71af5df95019a80657da88cd39a666dc670e0d2a.jpg"
	}
}