The attack that hacked RSA Security's network earlier this year succeeded because the company failed to take a basic security precaution, a researcher said Monday.
According to Rodrigo Branco, the director of Qualys' vulnerability and malware research labs, the malware targeted the decade-old Windows XP.
"The feeling is the target[ed PC] was running Windows XP SP3 ... with all the patches," said Branco in emailed answers to questions.
The problem, said Branco, is that while Windows XP includes the DEP (data execution prevention) defensive technology -- Microsoft added DEP to XP in 2004 with Service Pack 2 -- it's not switched on by default.
And RSA apparently neglected to turn it on.
Branco based his bet on his investigation into the exploit code that RSA confirmed had been used to break into its network.
That code exploited a then-unpatched vulnerability in Adobe Flash Player -- Adobe quashed the bug Mach 21, four days after RSA acknowledged the attack -- and followed by infecting the target PC with a customized variant of the Poison Ivy remote administration tool (RAT).
Branco eliminated Windows Vista and Windows 7 from the list of targeted operating systems because both enable DEP by default. DEP would have stymied the exploit from executing, he said.
Additionally, the exploit code would not execute on a Windows 7 PC because of changes to the kernel in that edition.
Targeting Windows XP is still a popular pastime for hackers. The "Aurora" campaign that breached Google's network -- and led it to threaten to pull its operations from the People's Republic of China -- and dozens of other Western companies also aimed to subvert Windows XP systems .
Branco believes that the RSA attackers either pegged the security firm as running Windows XP or simply assumed that the company, like many others, still relied on the aged operating system.
"This isn't difficult information to get from companies," said Branco. "Programs like browsers leak this information all the time."
There is an outside chance that the RSA attack did compromise a Windows Vista or Windows 7 machine, Branco said, noting that his research showed the exploit could have been modified to execute on those versions.
But he ultimately rejected that possibility.
"I don't think it was [modified to work on Vista or Windows 7], because apparently the exploit was re-used as is," Branco said, referring to the Flash exploit tucked into an Excel spreadsheet, the identified infection vector for the attack.
RSA could have prevented the expensive breach -- it spent $66 million replacing customers' SecurID tokens -- by either migrating its Windows XP machines to a newer OS, by isolating those XP PCs, or by enabling DEP on them, Branco concluded.
Sign up for CIO Asia eNewsletters.