Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers went undetected in Citrix’s internal network for six months

techcrunch.com

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Hackers went undetected in Citrix’s internal network for six months

#101

Post by Godel_unicode »

u801e wrote: post #87
IncRnd wrote: post #69

Earlier quoted context omitted.

A passphrase doesn't make it 3FA, since that is an already used factor class, what you know. 3FA is one from each category of what you know, what you have, and what you are. Depending on the implementation, what you describe may only be 1.5 factor auth.

I believe we can agree that just using a username/password for authentication is 1FA (single factor authentication). If we add a one-time token sent via SMS or email, or generated via TOTP, that's generally considered 2FA (with the username/password considered what you know and the one time token being what you have, I believe). What I proposed was using a client-side TLS certificate in combination with the username/…

As I have said other places in this thread, you're slowly reinventing Fido/u2f/(as was expanded by others)WebAuthn.

Re: Hackers went undetected in Citrix’s internal network for six months

#102

Post by Godel_unicode »

RugnirViking wrote: post #78
zachsnow wrote: post #42

Earlier quoted context omitted.

That website is very bad at conveying what it actually is to someone that might want to use it.

Indeed. I spent 10 or 15 minutes trying to figure out if they are selling a physical device, like a usb 'key' or are just selling 2 factor authentication with mobile phones. And I'm still none the wiser. It's pages upon pages of buzzwords and nonsense.

That's because it's not either-or. Read more slowly, it's a wide-ranging spec and there are many different implementations/extensions.

Re: Hackers went undetected in Citrix’s internal network for six months

#103

Post by Godel_unicode »

SpaethCo wrote: post #59
Godel_unicode wrote: post #19

Earlier quoted context omitted.

I understood you, my point is that you are sacrificing significant security with a one-factor approach, especially if that one factor is a password! You're open to attacks where the password is exposed in between the keyboard and the requestor, attacks on the distant end system, as well as attacks on the password device itself. Passwords make it tricky to audit if they've been duplicated. Use 2fa everywhere. It's che…

2FA only helps if it's a 2-way authentication mechanism like U2F. TOPT codes are completely phish-able using ridiculously easy to setup kits out there like CredSniper[0]. Set up a MITM proxy authentication site, get the user to live authenticate through the proxy, steal the session cookie, game over. Some of the feedback that has come out of internal campaigns has been things like "I thought the URL looked weird, but…

This is dangerously untrue; while totp is clearly not as secure as a hardware token, it's much more secure than just username/password. It requires the adversary to do more work, and also provides more clues for the server that something phishy is going on. It's also much easier to sell to users, especially for free-but-critical services like webmail. You're not going to convince everyone to buy a $30 hardware token to protect their free Gmail account; meet your users where they are.

By all means, move towards a hardware-based 2fa setup. But don't let that prevent intermediate steps to improve security along the way.

Your example is also deeply flawed as it can be used to steal auth tokens for 2fa sites, even if they use Fido. Mitm is game over.

Re: Hackers went undetected in Citrix’s internal network for six months

#104

Post by u801e »

Godel_unicode wrote: post #101
u801e wrote: post #87

Earlier quoted context omitted.

I believe we can agree that just using a username/password for authentication is 1FA (single factor authentication). If we add a one-time token sent via SMS or email, or generated via TOTP, that's generally considered 2FA (with the username/password considered what you know and the one time token being what you have, I believe). What I proposed was using a client-side TLS certificate in combination with the username/…

As I have said other places in this thread, you're slowly reinventing Fido/u2f/(as was expanded by others)WebAuthn.

Fido/u2f is only supported in certain places. What I'm talking about is supported by any server that supports TLS. For instance, news.ycombinator.com is running nginx. nginx supports using client-side TLS certificates. If the administrators of this website chose to enable it, they could allow me to submit a certificate signing request, sign it, and send me the resulting certificate. Then they could allow me to connect to this server using that certificate to authenticate me in addition to my username and password.

Also, this isn't tied into a specific application level protocol. This can be done over other other application level protocols like SMTP, IMAP, NNTP, IRC, etc.

From what I've read about U2F[1], you need to use Google Chrome. Just checking the preferences/settings for both Firefox and Chrome, they both have the option of importing client side TLS certificates. Thunderbird also has the option of importing client side TLS certificates.

To put it another way, my browser can tell I'm connecting to news.ycombinator.com by using the certificate authority bundle installed on my machine. I don't need any external service or new standard to accomplish this. The same principle applies to client side TLS certificates.

[1] https://www.yubico.com/solutions/fido-u2f/

Re: Hackers went undetected in Citrix’s internal network for six months

#105

Post by auiya »

cmroanirgo wrote: post #61
pandapower2 wrote: post #28

Earlier quoted context omitted.

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

Even more interesting is how the FBI knew they'd been infiltrated before they themselves did? (There's the obvious conspiracy style accusation in that they were already in there poking around... but that doesn't seem to ring true in this regard)

Same way any criminal investigator uncovers stolen goods.

Re: Hackers went undetected in Citrix’s internal network for six months

#106

Post by auiya »

drb91 wrote: post #46
bdibs wrote: post #35

Earlier quoted context omitted.

Proper audit logs that are regularly checked.

Assuming the exfiltration can be differentiated from normal behavior!

Seeing large amounts of encrypted traffic leaving via a DNS tunnel during non-standard business hours for instance would be an example of such an anomaly. It's not always that easy to detect however.

Re: Hackers went undetected in Citrix’s internal network for six months

#107

Post by IncRnd »

u801e wrote: post #87
IncRnd wrote: post #69

Earlier quoted context omitted.

A passphrase doesn't make it 3FA, since that is an already used factor class, what you know. 3FA is one from each category of what you know, what you have, and what you are. Depending on the implementation, what you describe may only be 1.5 factor auth.

I believe we can agree that just using a username/password for authentication is 1FA (single factor authentication). If we add a one-time token sent via SMS or email, or generated via TOTP, that's generally considered 2FA (with the username/password considered what you know and the one time token being what you have, I believe). What I proposed was using a client-side TLS certificate in combination with the username/…

Many security people will discount everything that someone says once they see that person misapply marketing-phrases to describe security technology.

2FA does not become 3FA when adding a new passphrase to a system that already had a knowledge based entry.

A password for a private key is _never_ considered what you are. You are severely misusing security terms and will mislead people to believe that a proposed solution has greater strength than it really possesses.

Re: Hackers went undetected in Citrix’s internal network for six months

#108

Post by u801e »

IncRnd wrote: post #107
u801e wrote: post #87

Earlier quoted context omitted.

I believe we can agree that just using a username/password for authentication is 1FA (single factor authentication). If we add a one-time token sent via SMS or email, or generated via TOTP, that's generally considered 2FA (with the username/password considered what you know and the one time token being what you have, I believe). What I proposed was using a client-side TLS certificate in combination with the username/…

Many security people will discount everything that someone says once they see that person misapply marketing-phrases to describe security technology. 2FA does not become 3FA when adding a new passphrase to a system that already had a knowledge based entry. A password for a private key is _never_ considered what you are. You are severely misusing security terms and will mislead people to believe that a proposed soluti…

> [You] will mislead people to believe that a proposed solution has greater strength than it really possesses.

Then explain how authentication via a username and password validated server side, a client-side TLS certificate validated during the negotiation of a TLS connection between the client and server, and a passphrase validated locally on the client's device is not a better solution compared to typical 2FA implementations using email, SMS, or TOTP.

Re: Hackers went undetected in Citrix’s internal network for six months

#109

Post by zild3d »

6wKZhFkquv wrote: post #74
ngcc_hk wrote: post #60

You need network sniffer and pattern recognition. Otherwise basically you hope some of the unusual activities will affect ids/ips (or touch internet). However if it is normal account you need some sort of intelligence to recognise and alert. Not many software can do this.

Throwaway, worked at Citrix. The unfortunate thing about this comment is that they sell Citrix Cloud as having the intelligence to detect anomalies exactly like this in your network.

Ouch. This page [0] hurts a little bit to read now. Feel free to grab their free ebook though! You'll learn how advanced analytics can help IT identify user behaviors, determine risk profiles, and assess and address potential threats

[0] https://www.citrix.com/analytics/prevent-security-breaches.h...

Re: Hackers went undetected in Citrix’s internal network for six months

#110

Post by Godel_unicode »

u801e wrote: post #108
IncRnd wrote: post #107

Earlier quoted context omitted.

Many security people will discount everything that someone says once they see that person misapply marketing-phrases to describe security technology. 2FA does not become 3FA when adding a new passphrase to a system that already had a knowledge based entry. A password for a private key is _never_ considered what you are. You are severely misusing security terms and will mislead people to believe that a proposed soluti…

> [You] will mislead people to believe that a proposed solution has greater strength than it really possesses. Then explain how authentication via a username and password validated server side, a client-side TLS certificate validated during the negotiation of a TLS connection between the client and server, and a passphrase validated locally on the client's device is not a better solution compared to typical 2FA imple…

Key-logger on the box your soft cert is on. Soft cert is comprised immediately, fully, and permanently. And you might never know. With email/sms, at least it's possible for you to realize they're compromised, and with TOTP the underlying keymat is likely not on the device so the attacker has to repeatedly win the race.

More importantly, this is also a false dichotomy, as the correct answer here is hardware protection of the private key, e.g. yubikey.

Post reply on HN