Citrix's Internal Network Hacked After a Password Spraying Attack

A data breach is never good news, but some incidents are definitely worse than others. If, for example, a small internet forum for DIY enthusiasts is hacked, the loot is not that great (some emails, possibly some passwords, and a few do-it-yourself tips). If, on the other hand, a company like Citrix is hacked, you have a lot to worry about.

Citrix is a multibillion-dollar company that sells a host of enterprise software solutions to hundreds of thousands of organizations. Among its clients, you'll find government and military agencies as well as most of the ventures on the Fortune 500 list. The tools Citrix sells include virtualization, data sharing, and VPN solutions which basically means that this company's products are responsible for handling an unimaginable amount of sensitive information which you really don't want to see falling into the wrong hands. On March 8, Citrix announced that it's investigating a data breach.

What does Citrix say?

In the official announcement, Stan Black, Citrix's Chief Information Security Officer, said that Citrix's big brass first heard about the incident on March 6, when the FBI contacted them. Apparently, as soon as they learned about the attack, they implemented measures to contain it, hired a cybersecurity firm, and started investigating. The company claims that the details are still scarce, but Mr. Black did point out that the perpetrators are "international cyber criminals", whatever that might entail.

Law enforcement isn't completely sure yet, but evidence apparently suggests that the hackers used a technique called password spraying to compromise some of Citrix' internal accounts. In simple terms, password spraying is the opposite of brute-forcing. Instead of trying a large number of different passwords on a single account, the hackers try a relatively short list of common, easy-to-guess passwords on many accounts. Because so many people use the same simple passwords, this technique is often successful, and at the same time, the relatively low number of failed login attempts helps hackers avoid triggering the rate-limiting mechanisms that some companies employ. According to Citrix, once the password spraying attack yielded results, the bad guys used some techniques to overcome another layer of security.

Citrix is still not sure what type of data was accessed exactly, but evidence suggests that the hackers have downloaded business documents and that the security of the company's services hasn't been compromised. Nevertheless, Stan Black pointed out that the investigation is ongoing and that as soon as they have "credible and actionable information", they will disclose it. This statement is particularly interesting in light of an NBC report that also came out on March 8.

What do other people say?

Most of the information in the said report was provided by Resecurity – a cybersecurity company that claims to know a lot more about the attack on Citrix than the official announcement discloses.

Charles Yoo, Resecurity's President, told NBC that his researchers had seen two attacks on Citrix – one in December and one at the beginning of last week. They reckon that they know who's responsible as well – an Iranian hacking group known as Iridium. Although Iridium has only just started exfiltrating data, Resecurity's investigation apparently reveals that the Iranian cybercriminals first broke into Citrix's network some ten years ago. Currently, the hackers are allegedly trying to get their hands on data about NASA and FBI projects as well as Saudi Aramco – Saudi Arabia's state oil company. According to Charles Yoo, Resecurity tried to get in touch with Citrix, but apparently, the notifications fell on deaf ears.

As of the time of writing, Citrix has neither confirmed nor denied Resecurity's claims, and because the official information is in short supply, we can't really be sure how bad the situation is.

What we do know is that Citrix fell victim to a password spraying attack, which means that some of its employees were using common, easy-to-guess passwords. And that, in and of itself, is terrifying enough.