5 ms·

> In March 2019, the Federal Bureau of Investigation (FBI) alerted Citrix they had reason to believe cybercriminals had gained access to the company’s internal

> In March 2019, the Federal Bureau of Investigation (FBI) alerted Citrix they had reason to believe cybercriminals had gained access to the company’s internal network. The FBI told Citrix the hackers likely got in using a technique called “password spraying,” a relatively crude but remarkably effective attack that attempts to access a large number of employee accounts (usernames/email addresses) using just a handful of common passwords. Pretty bad when the FBI has to step in and alert you that someone has brute forced their way into your servers.

zigzaggy 7y ago
(This is slightly off the topic of this story) Believe it or not this happens often. I work with R&D / high-tech small businesses that have 1-2 patents or some other IP. They provide services to the government but they aren't exactly flush with cash - meaning their infosec programs are slim. So they stay in contact with the FBI and other TLAs (three letter agencies) who will contact them from time to time to say "hey you may want to check your network, we think someone's broken in." Basically the FBI is the internet police for these infrastructure / science / tech / etc. firms. It's not hard to understand why this information isn't out on the street more.
- stingraycharles 7y ago
  Yes but we’re talking about Citrix here, not some random small business supplier. In Citrix’ case it is bad to be in the position that the FBI had to tell you someone was brute forcing your app.
  - deleted 7y ago
    [deleted]
  - zigzaggy 7y ago
    True, and I agree it is bad. But I stand by my original comment. I believe all this happens far more often than we know right now. I predict we'll be finding out in the not so distant future that we've all been targeted and breached. All our data are belong to them.
- solotronics 7y ago
  How are they finding out in the first place? Either they have the capability to watch and decrypt the overall public traffic or they are already inside themselves.
  - netsharc 7y ago
    Paranoid much? Other ways could be intelligence work: the FBI might be monitoring "hacker" hangouts and someone bragged about it/is selling access. If it was a nation state: The CIA might be inside their system (technically or personnel-wise) and saw evidence, and told the FBI.
  - streb-lo 7y ago
    Or someone trying to sell credentials or info from xyz.com tips people off in a hurry. Do we always need to jump straight to conspiracy...
  - NickNameNick 7y ago
    Usually it will be because they were investigating something else, and either seized a hackers device, or gained access to a hackers servers. Device or servers will then have evidence of the other things the hacker and thier associates have been doing. Sometimes criminals brag about things. Other times, the compromised infrastructure is used in other criminal activity that gets detected by the next victim, and the law enforcement agencies work thier way back.
    - mox1 7y ago
      The NSA will pass information like this to the FBI as well (through the NCIJTF). They usually omit / redline enough information to make it Unclassified.
  - kortilla 7y ago
    During other takedowns the FBI will seize a C&C server. They can then see which IP addresses it has talking to it.
  - Spooky23 7y ago
spydum 7y ago
As other poster mentioned this happens pretty regularly. Sometimes the FBI folks tips are extremely vague and end up as false positives as well.
basch 7y ago
Weird timing that Dec of 18 they forced a password reset to most of its Sharefile "customers." (aka including anyone who has ever received a file from someone through sharefile, and accidentally signed up for a service they didnt want.) https://krebsonsecurity.com/2018/12/a-breach-or-just-a-forced-password-reset/ https://krebsonsecurity.com/2018/12/a-breach-or-just-a-force... “This is not in response to a breach of Citrix products or services,” wrote spokesperson Jamie Buranich. I want to know if they knew already in December, and if they lied to the public and their customers. Maybe they could argue that "yes a breach happened, but this password reset was completely unrelated" but thats a load of livestockwash, if thats the case. Edit: maybe i should read the article. Looks like they were in back in October! Jamie is likely just a sacrificial lamb, who is there so they have a head to roll, but somebody on the executive team should be in trouble for that kind of lie, unless there were government gag orders. >Citrix’s letter was prompted by laws in virtually all U.S. states that require companies to notify affected consumers of any incident that jeopardizes their personal and financial data. Excuse my French, but thats fucking bullshit that they are just admitting to this a year and a half later.
- dublinben 7y ago
  As Matt Levine would say, this is probably securities fraud.
- xp84 7y ago
  Hmm... if their ethics are as good quality as their garbage "VPN" software, it wouldn't be surprising.
- ijpsud 7y ago
  From the article: > Resecurity also presented evidence that it notified Citrix of the breach as early as Dec. 28, 2018, a claim Citrix initially denied but later acknowledged.
Stierlitz 7y ago
> Pretty bad when the FBI has to step in and alert you that someone has brute forced their way into your servers. Yes ..
Traster 7y ago
Apparently this is more common than you expect. A company I worked for initiated an overhaul of our IT security because the FBI turned up in the CEOs office and basically said "Now we've warned you, shareholders can sue you if you don't act on this". Or atleasts thats the story everyone in the company were told. It seems plausible, because I can't see any other reason why the CEO would deliberately set fire to the entire development team for no reason.
- nitwit005 7y ago
  I assume this is why the FBI is mentioned so often in these stories. A lot of companies probably keep hacking incidents quiet, but acknowledge it once the FBI is involved.
  - pergadad 7y ago
    Bingo! We're seeing a case of survivorship bias as we only hear about the cases companies are unable to hide any longer.
mr_toad 7y ago
> they had reason to believe I’m a little curious to know how the FBI comes across this information. Monitoring communications of criminals? Informants?
- txcwpalpha 7y ago
  It's actually quite common. The typical series of events is something like: - criminal steals someone's SSN - criminal uses that SSN to steal an identity - the SSN owner notices their identity has been stolen and reports it to authorities - the authorities investigate and are able to trace it back to where it was stolen from (and sometimes even who stole it) - the authorities notify the company that was breached. It's more common with larger breaches with more stolen SSNs (and thus more people reporting that their SSN was stolen) because that catches the FBI's attention more readily and makes it easier to trace it back.
- jcrawfordor 7y ago
  txcwpalpha mentions one common path. It is also a pretty standard practice for law enforcement to perform forensics on seized C2 components (sometimes even replacing them with emulators or continuing to operate them for some time in order to collect additional data), so that they can identify and notify victims.

zigzaggy 7y ago

(This is slightly off the topic of this story) Believe it or not this happens often. I work with R&D / high-tech small businesses that have 1-2 patents or some other IP. They provide services to the government but they aren't exactly flush with cash - meaning their infosec programs are slim. So they stay in contact with the FBI and other TLAs (three letter agencies) who will contact them from time to time to say "hey you may want to check your network, we think someone's broken in." Basically the FBI is the internet police for these infrastructure / science / tech / etc. firms. It's not hard to understand why this information isn't out on the street more.

stingraycharles 7y ago
Yes but we’re talking about Citrix here, not some random small business supplier. In Citrix’ case it is bad to be in the position that the FBI had to tell you someone was brute forcing your app.
- deleted 7y ago
  [deleted]
- zigzaggy 7y ago
  True, and I agree it is bad. But I stand by my original comment. I believe all this happens far more often than we know right now. I predict we'll be finding out in the not so distant future that we've all been targeted and breached. All our data are belong to them.
solotronics 7y ago
How are they finding out in the first place? Either they have the capability to watch and decrypt the overall public traffic or they are already inside themselves.
- netsharc 7y ago
  Paranoid much? Other ways could be intelligence work: the FBI might be monitoring "hacker" hangouts and someone bragged about it/is selling access. If it was a nation state: The CIA might be inside their system (technically or personnel-wise) and saw evidence, and told the FBI.
- streb-lo 7y ago
  Or someone trying to sell credentials or info from xyz.com tips people off in a hurry. Do we always need to jump straight to conspiracy...
- NickNameNick 7y ago
  Usually it will be because they were investigating something else, and either seized a hackers device, or gained access to a hackers servers. Device or servers will then have evidence of the other things the hacker and thier associates have been doing. Sometimes criminals brag about things. Other times, the compromised infrastructure is used in other criminal activity that gets detected by the next victim, and the law enforcement agencies work thier way back.
  - mox1 7y ago
    The NSA will pass information like this to the FBI as well (through the NCIJTF). They usually omit / redline enough information to make it Unclassified.
- kortilla 7y ago
  During other takedowns the FBI will seize a C&C server. They can then see which IP addresses it has talking to it.
- Spooky23 7y ago

spydum 7y ago

As other poster mentioned this happens pretty regularly. Sometimes the FBI folks tips are extremely vague and end up as false positives as well.

basch 7y ago

Weird timing that Dec of 18 they forced a password reset to most of its Sharefile "customers." (aka including anyone who has ever received a file from someone through sharefile, and accidentally signed up for a service they didnt want.) https://krebsonsecurity.com/2018/12/a-breach-or-just-a-forced-password-reset/ https://krebsonsecurity.com/2018/12/a-breach-or-just-a-force... “This is not in response to a breach of Citrix products or services,” wrote spokesperson Jamie Buranich. I want to know if they knew already in December, and if they lied to the public and their customers. Maybe they could argue that "yes a breach happened, but this password reset was completely unrelated" but thats a load of livestockwash, if thats the case. Edit: maybe i should read the article. Looks like they were in back in October! Jamie is likely just a sacrificial lamb, who is there so they have a head to roll, but somebody on the executive team should be in trouble for that kind of lie, unless there were government gag orders. >Citrix’s letter was prompted by laws in virtually all U.S. states that require companies to notify affected consumers of any incident that jeopardizes their personal and financial data. Excuse my French, but thats fucking bullshit that they are just admitting to this a year and a half later.

dublinben 7y ago
As Matt Levine would say, this is probably securities fraud.
xp84 7y ago
Hmm... if their ethics are as good quality as their garbage "VPN" software, it wouldn't be surprising.
ijpsud 7y ago
From the article: > Resecurity also presented evidence that it notified Citrix of the breach as early as Dec. 28, 2018, a claim Citrix initially denied but later acknowledged.

Stierlitz 7y ago

> Pretty bad when the FBI has to step in and alert you that someone has brute forced their way into your servers. Yes ..

Traster 7y ago

Apparently this is more common than you expect. A company I worked for initiated an overhaul of our IT security because the FBI turned up in the CEOs office and basically said "Now we've warned you, shareholders can sue you if you don't act on this". Or atleasts thats the story everyone in the company were told. It seems plausible, because I can't see any other reason why the CEO would deliberately set fire to the entire development team for no reason.

nitwit005 7y ago
I assume this is why the FBI is mentioned so often in these stories. A lot of companies probably keep hacking incidents quiet, but acknowledge it once the FBI is involved.
- pergadad 7y ago
  Bingo! We're seeing a case of survivorship bias as we only hear about the cases companies are unable to hide any longer.

mr_toad 7y ago

> they had reason to believe I’m a little curious to know how the FBI comes across this information. Monitoring communications of criminals? Informants?

txcwpalpha 7y ago
It's actually quite common. The typical series of events is something like: - criminal steals someone's SSN - criminal uses that SSN to steal an identity - the SSN owner notices their identity has been stolen and reports it to authorities - the authorities investigate and are able to trace it back to where it was stolen from (and sometimes even who stole it) - the authorities notify the company that was breached. It's more common with larger breaches with more stolen SSNs (and thus more people reporting that their SSN was stolen) because that catches the FBI's attention more readily and makes it easier to trace it back.
jcrawfordor 7y ago
txcwpalpha mentions one common path. It is also a pretty standard practice for law enforcement to perform forensics on seized C2 components (sometimes even replacing them with emulators or continuing to operate them for some time in order to collect additional data), so that they can identify and notify victims.