Citrix receiver hack -
Looking for:
- Hacking Citrix Storefront Users – Securifera |
Citrix receiver hack -
Three days ago, at the end of last week, Citrix made the kind of announcement that no company wants to make. Black went on to say that no indication had been discovered that the security of any Citrix services or products had been compromised by the security breach. And how had the breach occurred? Password spraying sees attackers throw a relatively small number of common passwords at a large number of accounts.
The theory is that given enough users, someone is likely to have made the mistake of using one of the common passwords. Such tactics can be successful at sidestepping some of the mechanisms such as rate-limiting organisations put in place to deter hackers from trying to brute force their way into a specific account by throwing a large number of passwords at it. An NBC News report , however, has repeated claims of a security firm Resecurity that an Iranian-linked hacking gang known as Iridium was responsible for the attack.
Resecurity says it first alerted Citrix way back on December 28 that it was being targeted by the Iridium group — a gang that is being blamed for attacks against hundreds of government agencies, oil and gas companies, as well as technology firms. Other recent victims of the Iridium group include the Australian parliament. Found this article interesting? Follow Graham Cluley on Twitter or Mastodon to read more of the exclusive content we post. Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows.
Now an independent security analyst, he regularly makes media appearances and is an international public speaker on the topic of computer security, hackers, and online privacy. Follow him on Twitter at gcluley , on Mastodon at [email protected] , or drop him an email.
Yes, those kind of reverse proxy tools can help hackers get past 2FA but it certainly doesn't mean any of us should give up on using 2FA! Instead, users are presented with a dialog box to users requesting credentials when Receiver attempts to reconnect automatically.
For more information, see the Receiver for Windows documentation, in eDocs. By default, Auto Client Reconnect is enabled through policy settings at site level. User reauthentication is not required. Auto Client Reconnect works only if the server disconnects sessions when there is a broken or timed out connection. Disconnected sessions remain intact in system memory and are available for reconnection by Receiver.
The connection can be configured to reset, or log off, sessions with broken or timed out connections. When a session is reset, attempting to reconnect initiates a new session; rather than restoring a user to the same place in the application in use, the application is restarted.
If the server is configured to reset sessions, Auto Client Reconnect creates a new session. This process requires users to enter their credentials to log on to the server.
Automatic reconnection can fail if Receiver or the plug-in submits incorrect authentication information, which might occur during an attack or the server determines that too much time has elapsed since it detected the broken connection.
Failed to load featured products content, Please try again. Customers who viewed this article also viewed. Log in to Verify Download Permissions. Objective This article explains how to configure Automatic Client Re-connection. Configure Automatic Client Reconnection Users can be disconnected from their sessions because of unreliable networks, highly variable network latency, or range limitations of wireless devices.
Configure Auto Client Reconnect using the following policy settings: Auto client reconnect. Enables or disables automatic reconnection by Receiver after a connection has been interrupted.
Auto client reconnect authentication. Enables or disables the requirement for user authentication upon automatic reconnection Auto client reconnect logging. Enables or disables logging of reconnection events in the event log. Logging is disabled by default. When enabled, the server's System log captures information about successful and failed automatic reconnection events.
Each server stores information about reconnection events in its own System log; the server farm does not provide a combined log of reconnection events for all servers. Settings for connections also affect Auto Client Reconnect.
Configure connections for Automatic Client Reconnection By default, Auto Client Reconnect is enabled through policy settings at site level. Let's say that you have a session running and it gets dropped for whatever reason.
Comments
Post a Comment