Hackers went undetected in Citrix’s internal network for six months
1–10 of 122 posts
Re: Hackers went undetected in Citrix’s internal network for six months
#2Security is hard. On the upside, every breach is a chance to learn for everyone else. I hope they release more details on how it happened.
Is there any blog or news that summarizes such post-mortem lessons? Could be a nice project to collect that.
Re: Hackers went undetected in Citrix’s internal network for six months
#3>Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren’t protected with two-factor authentication.
Wow. This simply reinforces the fact that humans cannot, and should not, be trusted with actively maintaining security of a system especially if there could be significant economic consequences.
Would a password manager help in this? I don't know.
Probably a hardware token which controls all and any access to a system.
*Removed some ambiguous sentences.
Re: Hackers went undetected in Citrix’s internal network for six months
#4Probably too busy coming up with rad interview questions about red black trees and other useless shit.
Re: Hackers went undetected in Citrix’s internal network for six months
#5average is 206 days
Re: Hackers went undetected in Citrix’s internal network for six months
#6I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
Re: Hackers went undetected in Citrix’s internal network for six months
#7If you have anything of value, I absolutely guarantee you that there are hackers in your network right now.
One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.
Re: Hackers went undetected in Citrix’s internal network for six months
#8If you'd like a full perspective of the Citrix hack three security people from Detroit discussed it on a recent episode of their show, How they got hacked:
Re: Hackers went undetected in Citrix’s internal network for six months
#9I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
Just assume they only catch the dumbest 20%.
Re: Hackers went undetected in Citrix’s internal network for six months
#10>Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren’t protected with two-factor authentication. Wow. This simply reinforces the fact that humans cannot, and should not, be trusted with actively maintaining security of a system especially if there could be significant…
I was with you up until the last paragraph, but no. That's not 2fa, that's switching one factor for another.
People should use a password manager with an rng to generate and store passwords. IT departments should run password spraying attacks themselves as well as blacklisting known-compromised passwords. There's really good tooling for this (likely the same tooling this adversary used!)
Separately from this, people should use hardware 2fa tokens whose weakest link isn't the cell phone company support.
Edited for clarity.