Jump to content
OpenSecurity.global

Search the Community

Showing results for tags 'in the wild'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Cybersecurity
    • General Discussion
    • Questions
    • TLP Rainbow
    • Vulnerabilities
  • Dataleaks
    • Publicly disclosed
    • In flight remediation process
  • OpenSecurity.global
  • Privacy's General Discussion
  • Weird malware samples's -- discussion
  • Video game nasties's games games games
  • The Authenticationverse's Topics
  • The Podcast Club's Podcast Discussion
  • Conferences's BlackHat/Defcon/BSidesLV 2019
  • Conferences's CCC
  • Conferences's BSides Conferences
  • Conferences's UK Conferences
  • Conferences's EU Conferences
  • Open Source Intelligence (OSINT)'s OSINT Tools
  • Open Source Intelligence (OSINT)'s Techniques
  • Open Source Intelligence (OSINT)'s War Stories
  • Memes and Shitposting's Meme Safari
  • Reverse Engineering's Discussion
  • Exploit Development's Exploit Dev Chat
  • Security Research's General Discussion
  • Security Research's Weekly Questions
  • Irish Infosec's MeetUps
  • Irish Infosec's Only_In_Ireland
  • Irish Infosec's General Irish Chat
  • Live In a Simulation?'s Arguments for simulation
  • Cyber pets's CYBER PETS FROM THE FUTURE
  • Pond Diplomacy's Topics
  • Blue Team Club's Topics
  • Red Team Club's Topics
  • Pop Culture's Discuss Amazon's The Boys
  • Pop Culture's Disney’s The Lyin King
  • Pop Culture's Free For All
  • Mentoring's Conference Speaking
  • Mentoring's Career Progression
  • Careers's We're Hiring!
  • Careers's I'm Looking!
  • Careers's I want to break in!
  • Careers's CV Help or Career Guidance
  • DFIR's Tools
  • DFIR's General DFIR
  • Incident Response's Incident Response playbooks
  • Login Abuse and ATO Fraud detection/Mitigation techniques.'s Login Abuse and ATO Fraud detection/Mitigation techniques.
  • Yorkshire (UK) InfoSec's Misc Topics
  • Yorkshire (UK) InfoSec's Leeds
  • Yorkshire (UK) InfoSec's Sheffield
  • Colorado InfoSec's Meetups
  • Social Engineering's General SE Fun
  • Social Engineering's Defense
  • Social Engineering's Attacker Techniques
  • GET OFF MY LAWN!'s General Chat
  • Memory Forensics's Tools of the trade
  • Memory Forensics's Techniques
  • Memory Forensics's War Stories
  • Memory Forensics's Research
  • Memory Forensics's Resources
  • Appsec's Topics
  • Washington InfoSec's Security Conferences in or near Washington
  • Intelligence Monitoring Operations's Tradecraft (Tactics + Techniques)
  • Intelligence Monitoring Operations's Monitoring Strategies
  • Intelligence Monitoring Operations's Personas & OPSEC
  • Intelligence Monitoring Operations's Data Breach Leaks

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


About Me

Found 1 result

  1. The boilerplate description "A vulnerability has been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution." What it means in practice Unauthenticated remote code execution on internet connected Citrix Gateway devices = bad. Are attackers actually exploiting this vulnerability? Yes, at scale, against targeted and untargeted assets. Impact Lame stuff like coin miners, but also devices getting backdoored, and people trying to use this to deploy ransomware inside Windows orgs behind the Citrix boxes. Vendor advisory and patches Here: https://support.citrix.com/article/CTX267027 Checking if your device has already been exploited Check out this tool, which is getting frequent updates: https://github.com/fireeye/ioc-scanner-CVE-2019-19781/tree/v1.2 Scale of the issue Somewhere in the region of ~100k devices were exploitable with this back in December. After have a huge awareness campaign via all sorts of orgs, this one is about ~10k unpatched devices at present. Those orgs are still in serious danger of exploitation. If you patched late You want to run the FireEye tool linked above to look for exploitation, as attackers may have backdoored your device. I just applied the mitigations You should also apply the patch, as it hardens the setup - just the mitigations alone present some issues.
×
×
  • Create New...

Important Information

We use cookies as we're cookie monsters. Privacy Policy