Cyber Incident Victim: RSA Security LLC
Date:
Apr 2014
Location:
Syria
Summary
The Syrian Electronic Army redirected visitors of the RSA Conference website to a defacement page in retaliation for a presentation mocking their hacking methods. Attackers compromised an analytics service provider (Lucky Orange) through phishing emails targeting its DNS hosting company, obtaining credentials to alter a subdomain configuration. This manipulation caused the victim's site and other affected platforms using the service to load malicious content from SEA-controlled servers, disrupting normal access and displaying taunting messages. The incident impacted multiple websites relying on the compromised analytics infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The Syrian Electronic Army (SEA) executed a website redirection attack against the RSA Conference domain on April 29, 2014, following a presentation by Secure Mentem President Ira Winkler at the conference. Winkler had publicly mocked the hacking group's methods during his talk, which was later published as a video on the conference website. The SEA discovered this content and retaliated by redirecting visitors from the RSA Conference site to a defacement page displaying a taunting message directed at Winkler: "Dear Ira Winkler, Do you think that you are funny? Do you think that you are secure? You are NOT." The group announced their actions via Twitter, framing the attack as a response to Winkler's criticisms and recent security firm reports about their activities.
The compromise occurred through the exploitation of Lucky Orange, an analytics service used by the RSA Conference website. Attackers first targeted the DNS hosting provider managing Lucky Orange's infrastructure with phishing emails impersonating the company's CEO. These messages instructed employees to review a fabricated BBC article, leading them to a credential-harvesting site. An account executive fell victim to this scheme, providing login credentials that allowed SEA members to reset Lucky Orange's account password. Upon gaining access to the control panel, the attackers modified the 'w1.livestatserver.com' subdomain configuration that handled JavaScript calls for the analytics service. This alteration redirected all visitors with JavaScript-enabled browsers from the RSA Conference site—and any other websites using Lucky Orange—to SEA-controlled servers hosting the defacement image. Winkler later clarified in a blog post that the RSA Conference website itself wasn't directly breached, emphasizing the attack leveraged third-party service vulnerabilities. The incident demonstrated supply chain risks through compromised analytics infrastructure affecting multiple organizations simultaneously.