This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
Shame on me.
Security paradigms are shifting at a frightening pace. When RSA had its seed vault stolen nearly three months ago, I said the risk of it being used was low. By all appearances, I was wrong. Lockheed Martin is the first victim to say that knowledge of the seeds was used against it.
At the same time, we can't deny that this attack was targeted, carried out by a motivated attacker with significant financial resources, against a military (or strategic) target... Finally, a real APT-style attack!
It's hard to assess, since there's a certain omertà among the various groups involved. From the information that has been made public, we can deduce that the RSA attack was one step toward reaching the ultimate target, Lockheed Martin. We can also deduce that this new information merely made it easier for an effort that was already under way to infiltrate Lockheed Martin.
What I find interesting in this whole debacle is that it is now public knowledge that there are attackers out there and that they will do whatever it takes to reach their target: privileged information. And we all have information worth protecting, whether it's your credit card number or your client list. By the way, attackers don't attack firewalls, they look for the path of least resistance to your information… So if your only line of defense is a firewall and a SecurID token, it might be time to revisit your security.
