71–80 of 122 posts
If you'd like a full perspective of the Citrix hack three security people from Detroit discussed it on a recent episode of their show, How they got hacked: https://www.youtube.com/watch?v=fMgdrq0xMLk
> Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren’t protected with two-factor authentication. How did Citrix not have 2FA in place?
You need network sniffer and pattern recognition. Otherwise basically you hope some of the unusual activities will affect ids/ips (or touch internet). However if it is normal account you need some sort of intelligence to recognise and alert. Not many software can do this.
Earlier quoted context omitted.
This is extremely common. 6 months is not that long, even among competent companies that have good security. You usually hear about it from the FBI. I think the FBI forwards tips from agencies like the NSA, but they don’t tend to give much information.
It may be common, but I'll disagree it's common for companies with "good security." Password spraying doesn't work with good 2FA, nor sane login limits. I set off a flag anytime logging in from a new IP, for example.
Not saying Citrix security is perfect, but protecting yourself from this kind of attack is certainly not as simple as "Add 2FA and limit login attempts".
I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
And it sounds like Citrix didn't even notice, it was the FBI who noticed then alerted Citrix.
Has anyone gotten that kind of call from the FBI and can shed light on how the process works? Would be fascinating for a outsider and provide a guide on what next steps look like for those poor souls that receive the call in the future.
I've been on this call (both sides of it) probably a dozen times by now. Gov agencies are decent at doing research so it's pretty unlikely that the FBI just called their 1800 number or whatever. Most small start ups don't get to the level where anyone that "big" is looking at them but in the event that something does get flagged the agency will go find their CEO/CTO/counsel on LinkedIn and either message them there o…
Earlier quoted context omitted.
You're almost there, keep going a little farther, and you'll have eliminated passwords and invented FIDO. https://fidoalliance.org
That website is very bad at conveying what it actually is to someone that might want to use it.
Earlier quoted context omitted.
Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?
For some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow. So even if it's someone with valid access, it would be investigated immediately.
> Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren’t protected with two-factor authentication. How did Citrix not have 2FA in place?
Haven't read the article, don't know anything about their network. Assuming they use a Windows domain for their corp infrastructure. Lower level Windows authentication mechanisms can't be configured for 2FA. If your active directory domain is functional at all then at the very least your systems need to be able to talk via SMB and ldap to a domain controller. With sufficient privileges you're able to execute code on…