11–20 of 122 posts
I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
Just assume they only catch the dumbest 20%.
How did Citrix not have 2FA in place?
Security is hard. On the upside, every breach is a chance to learn for everyone else. I hope they release more details on how it happened. Is there any blog or news that summarizes such post-mortem lessons? Could be a nice project to collect that.
If you have anything of value, I absolutely guarantee you that there are hackers in your network right now. One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.
>Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren’t protected with two-factor authentication. Wow. This simply reinforces the fact that humans cannot, and should not, be trusted with actively maintaining security of a system especially if there could be significant…
I was with you up until the last paragraph, but no. That's not 2fa, that's switching one factor for another. People should use a password manager with an rng to generate and store passwords. IT departments should run password spraying attacks themselves as well as blacklisting known-compromised passwords. There's really good tooling for this (likely the same tooling this adversary used!) Separately from this, people…
This probably makes 2FA moot for some scenerios. For scenarios where losing the token is a real risk, you would implement 2FA.
average is 206 days
I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
Earlier quoted context omitted.
I was with you up until the last paragraph, but no. That's not 2fa, that's switching one factor for another. People should use a password manager with an rng to generate and store passwords. IT departments should run password spraying attacks themselves as well as blacklisting known-compromised passwords. There's really good tooling for this (likely the same tooling this adversary used!) Separately from this, people…
Probably my wording was wrong. I was thinking more of a system where the password itself was generated and stored on a hardware device. The user need not interact with any application, whatsoever, like 1Password or Lastpass to generate or store a password at all. Everything happens behind the scenes on the device. The user would be responsible only for keeping the hardware device safe. This probably makes 2FA moot fo…
Use 2fa everywhere. It's cheap, easy, and significantly more effective.
Consider the following attacks which your suggestion provides no coverage for:
- Http downgrade (both SSLstrip and export-grade downgrade)
- Spear-phish
- Key-logger
- Spear-phish
- Shoulder-surf
- Spear-phish
- Evil maid (borrows device and compromises passwords)
And last but not least, spear-phish
Having worked with Citrix, I'm shocked. Shocked that they detected it at all...
> [T]he hackers had “intermittent access” to its internal network from October 13, 2018 until March 8, 2019, two days after the FBI alerted the company to the breach.