Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers went undetected in Citrix’s internal network for six months

techcrunch.com

Post reply on HN
Print view View original

61–70 of 122 posts

Re: Hackers went undetected in Citrix’s internal network for six months

#61

Post by cmroanirgo »

pandapower2 wrote: post #28
todd3834 wrote: post #6

I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

Even more interesting is how the FBI knew they'd been infiltrated before they themselves did? (There's the obvious conspiracy style accusation in that they were already in there poking around... but that doesn't seem to ring true in this regard)

Re: Hackers went undetected in Citrix’s internal network for six months

#62

Post by SCHiM »

benmarks wrote: post #12

> Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren’t protected with two-factor authentication. How did Citrix not have 2FA in place?

Haven't read the article, don't know anything about their network. Assuming they use a Windows domain for their corp infrastructure.

Lower level Windows authentication mechanisms can't be configured for 2FA. If your active directory domain is functional at all then at the very least your systems need to be able to talk via SMB and ldap to a domain controller. With sufficient privileges you're able to execute code on other machines via either protocol.

You only need an infected machine, not even user credentials, to be able to perform password spraying or kerberoasting attacks.

Re: Hackers went undetected in Citrix’s internal network for six months

#63

Post by mirimir »

bdibs wrote: post #35
pandapower2 wrote: post #28

Earlier quoted context omitted.

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

Proper audit logs that are regularly checked.

Didn't Sony pick up exfiltration through exceptional data flows?

Re: Hackers went undetected in Citrix’s internal network for six months

#64

Post by rando444 »

pandapower2 wrote: post #28
todd3834 wrote: post #6

I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

For some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow.

So even if it's someone with valid access, it would be investigated immediately.

Re: Hackers went undetected in Citrix’s internal network for six months

#65

Post by mirimir »

giancarlostoro wrote: post #41
Godel_unicode wrote: post #32

Earlier quoted context omitted.

So you're saying they caught the attackers using one of the most sophisticated pieces of malware ever created. Good, we agree.

They caught the malware not the attackers. Otherwise we would be talking about the authors.

Given that the malware was seriously breaking shit, it wasn't all that hard to catch. I'm sure that at first they were looking for bugs, and thgen it became clear that it was too intentional.

Re: Hackers went undetected in Citrix’s internal network for six months

#66

Post by mirimir »

Thorrez wrote: post #17
todd3834 wrote: post #6

I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.

And it sounds like Citrix didn't even notice, it was the FBI who noticed then alerted Citrix.

I'm guessing that the FBI had indepenent downstream evidence.

Re: Hackers went undetected in Citrix’s internal network for six months

#68

Post by mtgx »

cmroanirgo wrote: post #61
pandapower2 wrote: post #28

Earlier quoted context omitted.

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

Even more interesting is how the FBI knew they'd been infiltrated before they themselves did? (There's the obvious conspiracy style accusation in that they were already in there poking around... but that doesn't seem to ring true in this regard)

If the FBI wasn't then NSA definitely was and then told the FBI.

Re: Hackers went undetected in Citrix’s internal network for six months

#69

Post by IncRnd »

u801e wrote: post #39
Godel_unicode wrote: post #10

Earlier quoted context omitted.

I was with you up until the last paragraph, but no. That's not 2fa, that's switching one factor for another. People should use a password manager with an rng to generate and store passwords. IT departments should run password spraying attacks themselves as well as blacklisting known-compromised passwords. There's really good tooling for this (likely the same tooling this adversary used!) Separately from this, people…

> People should use a password manager with an rng to generate and store passwords. [...] > Separately from this, people should use hardware 2fa tokens whose weakest link isn't the cell phone company support. What would be better is to support certificate based authentication in combination with a username and password. Then you have 2FA without having to share the private key. You can even get 3FA if the private key…

A passphrase doesn't make it 3FA, since that is an already used factor class, what you know. 3FA is one from each category of what you know, what you have, and what you are. Depending on the implementation, what you describe may only be 1.5 factor auth.

Re: Hackers went undetected in Citrix’s internal network for six months

#70

Post by IncRnd »

pandapower2 wrote: post #28
todd3834 wrote: post #6

I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

Why do you assume this was an unauthorized person?
Post reply on HN