Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers went undetected in Citrix’s internal network for six months

techcrunch.com

Post reply on HN
Print view View original

31–40 of 122 posts

Re: Hackers went undetected in Citrix’s internal network for six months

#31

Post by axaxs »

lawnchair_larry wrote: post #26
da_chicken wrote: post #20

Earlier quoted context omitted.

I was going to say the same thing, but it sounds like it was the FBI that noticed it: > [T]he hackers had “intermittent access” to its internal network from October 13, 2018 until March 8, 2019, two days after the FBI alerted the company to the breach.

This is extremely common. 6 months is not that long, even among competent companies that have good security. You usually hear about it from the FBI. I think the FBI forwards tips from agencies like the NSA, but they don’t tend to give much information.

It may be common, but I'll disagree it's common for companies with "good security." Password spraying doesn't work with good 2FA, nor sane login limits. I set off a flag anytime logging in from a new IP, for example.

Re: Hackers went undetected in Citrix’s internal network for six months

#32

Post by Godel_unicode »

lawnchair_larry wrote: post #27
Godel_unicode wrote: post #11

Earlier quoted context omitted.

So you think that 80% of attacks are better than stuxnet?

They never caught the stuxnet attacks. They caught the malware that was spreading far outside of its target. Not quite the same thing.

So you're saying they caught the attackers using one of the most sophisticated pieces of malware ever created. Good, we agree.

Re: Hackers went undetected in Citrix’s internal network for six months

#33

Post by viraptor »

empath75 wrote: post #7

If you have anything of value, I absolutely guarantee you that there are hackers in your network right now. One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.

That's a really defeatist attitude. There are different levels of "value" and different levels of protection. Not everything is internet facing. Not everything is managed like a corp where turnover requires lots of access changes. Not everything allows you persistence in the network. And not all access is "access".

I really wish we moved past the "everybody's owned" idea. Your defence should be proportional to the value you can lose. You can monitor for the rest. And you can't guarantee the are hackers in my network. (Unless you're saying you're guilty of breaking in? ;-) )

Re: Hackers went undetected in Citrix’s internal network for six months

#34

Post by Godel_unicode »

inapis wrote: post #29
Godel_unicode wrote: post #19

Earlier quoted context omitted.

I understood you, my point is that you are sacrificing significant security with a one-factor approach, especially if that one factor is a password! You're open to attacks where the password is exposed in between the keyboard and the requestor, attacks on the distant end system, as well as attacks on the password device itself. Passwords make it tricky to audit if they've been duplicated. Use 2fa everywhere. It's che…

I do not believe that spearphishing would not be prevented by a hardware token. The device would be responsible for authenticating the identity of the service being accessed. If the user can be fooled into handing over their hardware token, I do not see it far fetched that they will not be influenced to not hand over their 2FA token. Again, if a hardware 2FA token can deal with key-loggers, so can a password token. W…

You're almost there, keep going a little farther, and you'll have eliminated passwords and invented FIDO.

https://fidoalliance.org

Re: Hackers went undetected in Citrix’s internal network for six months

#35

Post by bdibs »

pandapower2 wrote: post #28
todd3834 wrote: post #6

I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

Proper audit logs that are regularly checked.

Re: Hackers went undetected in Citrix’s internal network for six months

#36

Post by inapis »

Godel_unicode wrote: post #34
inapis wrote: post #29

Earlier quoted context omitted.

I do not believe that spearphishing would not be prevented by a hardware token. The device would be responsible for authenticating the identity of the service being accessed. If the user can be fooled into handing over their hardware token, I do not see it far fetched that they will not be influenced to not hand over their 2FA token. Again, if a hardware 2FA token can deal with key-loggers, so can a password token. W…

You're almost there, keep going a little farther, and you'll have eliminated passwords and invented FIDO. https://fidoalliance.org

Ha. Perfect. That is exactly what I was imagining. Apologies for the long conversation.

Do you have any idea why this is not popular? Is it too hard to implement or is it just that business's do not see security as something to invest a lot in?

Re: Hackers went undetected in Citrix’s internal network for six months

#37

Post by andyv »

empath75 wrote: post #7

If you have anything of value, I absolutely guarantee you that there are hackers in your network right now. One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.

... and if you don't have anything of value, they came, looked and left.

Re: Hackers went undetected in Citrix’s internal network for six months

#38

Post by Godel_unicode »

inapis wrote: post #36
Godel_unicode wrote: post #34

Earlier quoted context omitted.

You're almost there, keep going a little farther, and you'll have eliminated passwords and invented FIDO. https://fidoalliance.org

Ha. Perfect. That is exactly what I was imagining. Apologies for the long conversation. Do you have any idea why this is not popular? Is it too hard to implement or is it just that business's do not see security as something to invest a lot in?

Most major SaaS apps support it, the major hardware provider I see recommended is yubikey although Google makes one as well. See also U2f. It's super easy to implement, try it out for yourself in Flask.

https://www.yubico.com/solutions/fido-u2f/

https://cloud.google.com/titan-security-key/

https://github.com/herrjemand/flask-fido-u2f

Re: Hackers went undetected in Citrix’s internal network for six months

#39

Post by u801e »

Godel_unicode wrote: post #10
inapis wrote: post #3

>Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren’t protected with two-factor authentication. Wow. This simply reinforces the fact that humans cannot, and should not, be trusted with actively maintaining security of a system especially if there could be significant…

I was with you up until the last paragraph, but no. That's not 2fa, that's switching one factor for another. People should use a password manager with an rng to generate and store passwords. IT departments should run password spraying attacks themselves as well as blacklisting known-compromised passwords. There's really good tooling for this (likely the same tooling this adversary used!) Separately from this, people…

> People should use a password manager with an rng to generate and store passwords.

[...]

> Separately from this, people should use hardware 2fa tokens whose weakest link isn't the cell phone company support.

What would be better is to support certificate based authentication in combination with a username and password. Then you have 2FA without having to share the private key. You can even get 3FA if the private key requires a passphrase to decrypt it.

Using SMS or email based 2FA is not secure (or is only as secure as the email or cell phone account as you already pointed out). Using TOTP requires sharing a secret between the device and the server.

Re: Hackers went undetected in Citrix’s internal network for six months

#40

Post by rishabhd »

axaxs wrote: post #18

Having worked with Citrix, I'm shocked. Shocked that they detected it at all...

Having responded to multiple incidents across sectors, can confirm that extensive reconnaissance and long term operations are becoming a norm. During one instance, the attackers were present in the system of a client for more than 18 months and had gained an amazing understanding of their operational procedures, policies and security architecture to say the least.
Post reply on HN