Improve company productivity with a Business Account.Sign Up

x
?
Solved

remote access gateway vulns

Posted on 2012-03-12
4
Medium Priority
?
478 Views
Last Modified: 2012-03-15
1) Our IT department seem of the view that if citrix remote access gateawy requires 2 factor authentication then we are pretty secure? Whats your view on that opinion?

2) If you only publish citrix to the world, are there still other attack vectors on that citrix CAG gateway server that could allow a hacker to gain access to the LAN?

3) Is the view that 2-factor is all thats required very naive?

4) Can you give some examples of other vulns you could find on a citrix CAG server that could still allow an attacker to get unauthorised access to the LAN - and/or compensating cotnrols to block these additional attack vectors?
0
Comment
Question by:pma111
  • 2
  • 2
4 Comments
 
LVL 26

Accepted Solution

by:
Tony J earned 2000 total points
ID: 37709251
Two factor authentication certainly helps because it relies on something that a user has in their possession and utilises single-use keys of some kind, so unless a keylogger can send the information and it be used within around 30seconds of being entered, it's all but useless.

On it's own though it's not enough - unencrypted traffic could be compromised using a man-in-the-middle attack where the information sent between two computers actually passes through a third, that transparently reads the informatin and prentends to each end point that it is the other. To name but one.

Using technology such as CAGs helps because encryption is usually a requirement.

These devices tend to be incredibly secure because they're some form of Linux based operating system with only the necessary ports open. Linux by its very nature tends to be more secure than Windows, but any OS and any appliance may be vulnerable.

I cannot, though, give any real-world experiences I've seen or even heard of of CAGs being sufficiently compromised to the extent that they give attackers control of systems or even direct access to information.
0
 
LVL 3

Author Comment

by:pma111
ID: 37709311
Ok thanks. I was thinking perhaps there may be more running on a citix server than citrix, in which case a vulnerability in "the other" may still provide an attack point?
0
 
LVL 3

Author Comment

by:pma111
ID: 37709408
So citrix is based on linux?
0
 
LVL 26

Expert Comment

by:Tony J
ID: 37709552
Ah no - if you use the Citrix Secure Gateway, then this installs over Windows and uses IIS, so yes you have a higher attack profile.

However, the Citrix Access Gateway and NetScaler products are hardened, cut-down Linux variants so don't have this issue. These are appliances - physical devices, although the CAG VPX is a virtual appliance and can be installed on the likes of XenServer (virtualisation hypervisor)
0

Featured Post

Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

A question that many companies need to answer until May 25th of 2018... Is your company ready for GDPR?
Cloud computing is a model of provisioning IT services. By combining many servers into one large pool and providing virtual machines from that resource pool, it provides IT services that let customers acquire resources at any time and get rid of the…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question