This message was deleted.
# citrix-netscalers
Slackbot
10/18/2023, 1:06 PMThis message was deleted.
😱 1
j
Josh Bilsky
10/18/2023, 3:49 PMThis is concerning, how do we know if we were exploited without any IoC script?
m
Mads Petersen
10/18/2023, 3:57 PMRead the source from Mandiant: https://www.mandiant.com/resources/blog/remediation-netscaler-adc-gateway-cve-2023-4966 / https://services.google.com/fh/files/misc/citrix-netscaler-adc-gateway-cve-2023-4966-remediation.pdf
To date, Mandiant has not identified any available logs or other artifacts resident on NetScaler appliances that record evidence of exploitation. Scoping an investigation has consisted of: – Reviewing NetScaler appliances for evidence of backdoors or web shells. – Identifying suspicious logons / lateral movement originating from published systems or resources accessible through the NetScaler appliances. – Correlating authentication and logon events (e.g., VDI systems published through NetScaler appliances) sourced from geographic locations that are not part of an established baseline. – Correlating authentication and logon events where a successful MFA challenge / response was not logged.
j
Jan Tytgat
10/18/2023, 4:45 PMBasically, nobody knows as of now, except through external indication of irregular activities (which is often something that organisations don’t have the money to monitor for)
c
CTXMike
10/18/2023, 4:47 PMI doubt they'll release IoCs for this one, wasn't it CERT or some other gov org that did it last time?
j
Jan Tytgat
10/18/2023, 4:48 PMNo NetScaler came with IoC as soon as they seems fit to release them
c
CTXMike
10/18/2023, 4:48 PMwhich was after the gov report, wasn't it?
j
Jan Tytgat
10/18/2023, 4:49 PMCan’t create an IoC detection script as long as there are no IoC 😅 🔫
m
Mads Petersen
10/18/2023, 4:58 PMDon't think the world should expect IoC released from NetScalers in general, only two have ever been released as far as i can remember over the last 15 years
c
CTXMike
10/18/2023, 4:58 PMexactly
CTXMike
10/18/2023, 5:00 PM(and for the record they don't share details with SEs either - they know as much as the outside world)
j
Josh Bilsky
10/18/2023, 5:25 PMIf you're using MFA, and there are no persistent sessions, then I would think the biggest concern is if an actor put a backdoor or webshell on the device, but nobody has found such activity to my knowledge so we just wait?
m
Mads Petersen
10/18/2023, 5:26 PMNot much to do really, doesn't sound like the overflow has lead to RCE, so session hijack is what has been seen.
👍 1
j
Jan Tytgat
10/18/2023, 5:27 PMIf I’m nog mistaken, it’s about session hijacking through the leakage of credentials (due to the vulnerability). No webshells involved at this point.
👍 1
s
saimen
10/19/2023, 7:31 AMso should all users that had access to a gateway configured on the patched netscaler, change there password even if they all have mfa?
m
Mads Petersen
10/19/2023, 10:23 AMWell if you think you have been compromised, then that wouldn't be enough, since the attacker might be able to do lateral movement. But you would have to look for signs on compromise on the connected solutions, not the NetScaler itself
s
saimen
10/20/2023, 9:56 AMSince as there is no concrete evidence to confirm if a netscaler is compromised and the firmware update seems to be not enough, my question was what others have done additionally
m
Mads Petersen
10/20/2023, 2:56 PMWhat I’m seeing is that they are looking in SEIM to see if there is anything out of the ordinary going on. So a little more eyes on login and Superman syndrome, but else business as usual