Earlier quoted context omitted.
And it sounds like Citrix didn't even notice, it was the FBI who noticed then alerted Citrix.
So, while the FBI was hacking they found another hacker?
Allegedly ;)
Hackers went undetected in Citrix’s internal network for six months
81–90 of 122 posts
Re: Hackers went undetected in Citrix’s internal network for six months
#82Earlier quoted context omitted.
For some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow. So even if it's someone with valid access, it would be investigated immediately.
Which tools do you use? I have been looking for something that does this.
In the Marriot hack post-mortem, they shared that one of the tools they used (which successfully identified the attack) was IBM Guardium.
> Accenture told Marriott's IT staff that one of their security products, a database monitoring system called IBM Guardium, had detected an anomaly on the Starwood guest reservation database
https://www.zdnet.com/article/marriott-ceo-shares-post-morte...
Re: Hackers went undetected in Citrix’s internal network for six months
#83Earlier quoted context omitted.
For some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow. So even if it's someone with valid access, it would be investigated immediately.
Which tools do you use? I have been looking for something that does this.
I'm guessing snort or one on the similar products.
Re: Hackers went undetected in Citrix’s internal network for six months
#84I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
THIS! My brother works for a large corp that does a lot of government(and private) work. A few years back, they tightened up their security with live monitoring, and as soon as it was enabled they realized that folks from China were actively connected. FBI was involved, but it never made the news. 2-3 more attempts have been made since. While they have an idea how long they had been breached, they don't know for sure...
Re: Hackers went undetected in Citrix’s internal network for six months
#85Earlier quoted context omitted.
I thought it was pretty well-established that Stuxnet was created/authored by TAO within the NSA.
Thats the belief but was it truly ever confirmed? I dont doubt it it sounds like a meme worthy of belief and I lean towards it but I dont recall ever finding a confirmation. Also saying they were caught implies the law caught them and arrested them.
It appears a US military general was pardoned by Obama for leaking details and US/Israeli involvement in it.
https://foreignpolicy.com/2016/10/17/obamas-general-pleads-g...
Re: Hackers went undetected in Citrix’s internal network for six months
#86Has anyone gotten that kind of call from the FBI and can shed light on how the process works? Would be fascinating for a outsider and provide a guide on what next steps look like for those poor souls that receive the call in the future.
I've been on this call (both sides of it) probably a dozen times by now. Gov agencies are decent at doing research so it's pretty unlikely that the FBI just called their 1800 number or whatever. Most small start ups don't get to the level where anyone that "big" is looking at them but in the event that something does get flagged the agency will go find their CEO/CTO/counsel on LinkedIn and either message them there o…
I learned a lot from this. Thanks.
Re: Hackers went undetected in Citrix’s internal network for six months
#87Earlier quoted context omitted.
> People should use a password manager with an rng to generate and store passwords. [...] > Separately from this, people should use hardware 2fa tokens whose weakest link isn't the cell phone company support. What would be better is to support certificate based authentication in combination with a username and password. Then you have 2FA without having to share the private key. You can even get 3FA if the private key…
A passphrase doesn't make it 3FA, since that is an already used factor class, what you know. 3FA is one from each category of what you know, what you have, and what you are. Depending on the implementation, what you describe may only be 1.5 factor auth.
I believe we can agree that just using a username/password for authentication is 1FA (single factor authentication). If we add a one-time token sent via SMS or email, or generated via TOTP, that's generally considered 2FA (with the username/password considered what you know and the one time token being what you have, I believe).
What I proposed was using a client-side TLS certificate in combination with the username/password for authentication. If the private key corresponding to that certificate requires a passphrase to decrypt, then it should be more than 2FA. What you know is the username/password, what you have is the private key. Whether the passphrase for that private key is considered what you know vs what you are is debatable (since, unlike the username/password or one-time token, the secret isn't shared by transmitting it over the network).
Re: Hackers went undetected in Citrix’s internal network for six months
#88I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
THIS! My brother works for a large corp that does a lot of government(and private) work. A few years back, they tightened up their security with live monitoring, and as soon as it was enabled they realized that folks from China were actively connected. FBI was involved, but it never made the news. 2-3 more attempts have been made since. While they have an idea how long they had been breached, they don't know for sure…
> folks from China
I assume you rather meant 'connections originating from IP addresses owned by Chinese companies'? It's trivial to use IP address from any place in the world, regardless of your actual location.
Re: Hackers went undetected in Citrix’s internal network for six months
#89Earlier quoted context omitted.
Haven't read the article, don't know anything about their network. Assuming they use a Windows domain for their corp infrastructure. Lower level Windows authentication mechanisms can't be configured for 2FA. If your active directory domain is functional at all then at the very least your systems need to be able to talk via SMB and ldap to a domain controller. With sufficient privileges you're able to execute code on…
Not sure what you meant by lower level mechanisms, but you can protect console logins and RDP with 2FA: https://duo.com/docs/rdp https://help.duo.com/s/article/1084?language=en_US
Those don't apply to "SMB and ldap", nor kerberos. The only way to get 2FA on an Active Directory domain is with PKI.
Re: Hackers went undetected in Citrix’s internal network for six months
#90Earlier quoted context omitted.
THIS! My brother works for a large corp that does a lot of government(and private) work. A few years back, they tightened up their security with live monitoring, and as soon as it was enabled they realized that folks from China were actively connected. FBI was involved, but it never made the news. 2-3 more attempts have been made since. While they have an idea how long they had been breached, they don't know for sure…
> folks from China I assume you rather meant 'connections originating from IP addresses owned by Chinese companies'? It's trivial to use IP address from any place in the world, regardless of your actual location.
I mean from China. It was investigated and pretty conclusively linked. Is there a chance that it wasn't China? sure. But there were specific reasons that China would want to know what this company was working on, and it was more than just an IP address cross reference that pointed to them. Now don't conflate this as "US=good, China=bad" that isn't what Im saying here. Im saying that Chinese state sponsored hackers accessed their computer systems, with reasonably credible evidence.