[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

remote access gateway vulns

Posted on 2012-03-12
4
Medium Priority
?
476 Views
Last Modified: 2012-03-15
1) Our IT department seem of the view that if citrix remote access gateawy requires 2 factor authentication then we are pretty secure? Whats your view on that opinion?

2) If you only publish citrix to the world, are there still other attack vectors on that citrix CAG gateway server that could allow a hacker to gain access to the LAN?

3) Is the view that 2-factor is all thats required very naive?

4) Can you give some examples of other vulns you could find on a citrix CAG server that could still allow an attacker to get unauthorised access to the LAN - and/or compensating cotnrols to block these additional attack vectors?
0
Comment
Question by:pma111
  • 2
  • 2
4 Comments
 
LVL 26

Accepted Solution

by:
Tony J earned 2000 total points
ID: 37709251
Two factor authentication certainly helps because it relies on something that a user has in their possession and utilises single-use keys of some kind, so unless a keylogger can send the information and it be used within around 30seconds of being entered, it's all but useless.

On it's own though it's not enough - unencrypted traffic could be compromised using a man-in-the-middle attack where the information sent between two computers actually passes through a third, that transparently reads the informatin and prentends to each end point that it is the other. To name but one.

Using technology such as CAGs helps because encryption is usually a requirement.

These devices tend to be incredibly secure because they're some form of Linux based operating system with only the necessary ports open. Linux by its very nature tends to be more secure than Windows, but any OS and any appliance may be vulnerable.

I cannot, though, give any real-world experiences I've seen or even heard of of CAGs being sufficiently compromised to the extent that they give attackers control of systems or even direct access to information.
0
 
LVL 3

Author Comment

by:pma111
ID: 37709311
Ok thanks. I was thinking perhaps there may be more running on a citix server than citrix, in which case a vulnerability in "the other" may still provide an attack point?
0
 
LVL 3

Author Comment

by:pma111
ID: 37709408
So citrix is based on linux?
0
 
LVL 26

Expert Comment

by:Tony J
ID: 37709552
Ah no - if you use the Citrix Secure Gateway, then this installs over Windows and uses IIS, so yes you have a higher attack profile.

However, the Citrix Access Gateway and NetScaler products are hardened, cut-down Linux variants so don't have this issue. These are appliances - physical devices, although the CAG VPX is a virtual appliance and can be installed on the likes of XenServer (virtualisation hypervisor)
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Phishing emails are a popular malware delivery vehicle for attack.  While there are many ways for an attacker to increase the chances of success for their phishing emails, one of the most effective methods involves spoofing the message to appear to …
It’s a season to be thankful, and we’re thankful for users like you who engage on site, solve technology problems, and network with others in the industry. What tech are we most thankful for? Keep reading.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
Suggested Courses

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question