Hacker News Reader

Comment by streb-lo | Hacker News Reader

> In March 2019, the Federal Bureau of Investigation (FBI) alerted Citrix they had reason to believe cybercriminals had gained access to the company’s internal network. The FBI told Citrix the hackers likely got in using a technique called “password spraying,” a relatively crude but remarkably effective attack that attempts to access a large number of employee accounts (usernames/email addresses) using just a handful of common passwords.

Pretty bad when the FBI has to step in and alert you that someone has brute forced their way into your servers.

View on HN

Weird timing that Dec of 18 they forced a password reset to most of its Sharefile "customers." (aka including anyone who has ever received a file from someone through sharefile, and accidentally signed up for a service they didnt want.)

https://krebsonsecurity.com/2018/12/a-breach-or-just-a-force...

“This is not in response to a breach of Citrix products or services,” wrote spokesperson Jamie Buranich.

I want to know if they knew already in December, and if they lied to the public and their customers. Maybe they could argue that "yes a breach happened, but this password reset was completely unrelated" but thats a load of livestockwash, if thats the case.

Edit: maybe i should read the article. Looks like they were in back in October! Jamie is likely just a sacrificial lamb, who is there so they have a head to roll, but somebody on the executive team should be in trouble for that kind of lie, unless there were government gag orders.

>Citrix’s letter was prompted by laws in virtually all U.S. states that require companies to notify affected consumers of any incident that jeopardizes their personal and financial data.

Excuse my French, but thats fucking bullshit that they are just admitting to this a year and a half later.

As Matt Levine would say, this is probably securities fraud.

From the article:

> Resecurity also presented evidence that it notified Citrix of the breach as early as Dec. 28, 2018, a claim Citrix initially denied but later acknowledged.

Hmm... if their ethics are as good quality as their garbage "VPN" software, it wouldn't be surprising.

(This is slightly off the topic of this story) Believe it or not this happens often. I work with R&D / high-tech small businesses that have 1-2 patents or some other IP. They provide services to the government but they aren't exactly flush with cash - meaning their infosec programs are slim. So they stay in contact with the FBI and other TLAs (three letter agencies) who will contact them from time to time to say "hey you may want to check your network, we think someone's broken in."

Basically the FBI is the internet police for these infrastructure / science / tech / etc. firms. It's not hard to understand why this information isn't out on the street more.

Yes but we’re talking about Citrix here, not some random small business supplier. In Citrix’ case it is bad to be in the position that the FBI had to tell you someone was brute forcing your app.

True, and I agree it is bad. But I stand by my original comment. I believe all this happens far more often than we know right now. I predict we'll be finding out in the not so distant future that we've all been targeted and breached. All our data are belong to them.

How are they finding out in the first place? Either they have the capability to watch and decrypt the overall public traffic or they are already inside themselves.

Usually it will be because they were investigating something else, and either seized a hackers device, or gained access to a hackers servers.

Device or servers will then have evidence of the other things the hacker and thier associates have been doing.

Sometimes criminals brag about things.

Other times, the compromised infrastructure is used in other criminal activity that gets detected by the next victim, and the law enforcement agencies work thier way back.

The NSA will pass information like this to the FBI as well (through the NCIJTF). They usually omit / redline enough information to make it Unclassified.

During other takedowns the FBI will seize a C&C server. They can then see which IP addresses it has talking to it.

Paranoid much? Other ways could be intelligence work: the FBI might be monitoring "hacker" hangouts and someone bragged about it/is selling access.

If it was a nation state: The CIA might be inside their system (technically or personnel-wise) and saw evidence, and told the FBI.

Or someone trying to sell credentials or info from xyz.com tips people off in a hurry. Do we always need to jump straight to conspiracy...

There are a few programs where they get visibility. The fusion centers in each state, for example can detect some of this type of activity.

Apparently this is more common than you expect. A company I worked for initiated an overhaul of our IT security because the FBI turned up in the CEOs office and basically said "Now we've warned you, shareholders can sue you if you don't act on this". Or atleasts thats the story everyone in the company were told. It seems plausible, because I can't see any other reason why the CEO would deliberately set fire to the entire development team for no reason.

I assume this is why the FBI is mentioned so often in these stories. A lot of companies probably keep hacking incidents quiet, but acknowledge it once the FBI is involved.

Bingo! We're seeing a case of survivorship bias as we only hear about the cases companies are unable to hide any longer.

As other poster mentioned this happens pretty regularly. Sometimes the FBI folks tips are extremely vague and end up as false positives as well.

> they had reason to believe

I’m a little curious to know how the FBI comes across this information. Monitoring communications of criminals? Informants?

It's actually quite common. The typical series of events is something like:

- criminal steals someone's SSN

- criminal uses that SSN to steal an identity

- the SSN owner notices their identity has been stolen and reports it to authorities

- the authorities investigate and are able to trace it back to where it was stolen from (and sometimes even who stole it)

- the authorities notify the company that was breached.

It's more common with larger breaches with more stolen SSNs (and thus more people reporting that their SSN was stolen) because that catches the FBI's attention more readily and makes it easier to trace it back.

txcwpalpha mentions one common path. It is also a pretty standard practice for law enforcement to perform forensics on seized C2 components (sometimes even replacing them with emulators or continuing to operate them for some time in order to collect additional data), so that they can identify and notify victims.

> Pretty bad when the FBI has to step in and alert you that someone has brute forced their way into your servers.

Yes ..

Reply on news.ycombinator.com