Solved

remote access gateway vulns

Posted on 2012-03-12
4
458 Views
Last Modified: 2012-03-15
1) Our IT department seem of the view that if citrix remote access gateawy requires 2 factor authentication then we are pretty secure? Whats your view on that opinion?

2) If you only publish citrix to the world, are there still other attack vectors on that citrix CAG gateway server that could allow a hacker to gain access to the LAN?

3) Is the view that 2-factor is all thats required very naive?

4) Can you give some examples of other vulns you could find on a citrix CAG server that could still allow an attacker to get unauthorised access to the LAN - and/or compensating cotnrols to block these additional attack vectors?
0
Comment
Question by:pma111
  • 2
  • 2
4 Comments
 
LVL 25

Accepted Solution

by:
Tony Johncock earned 500 total points
ID: 37709251
Two factor authentication certainly helps because it relies on something that a user has in their possession and utilises single-use keys of some kind, so unless a keylogger can send the information and it be used within around 30seconds of being entered, it's all but useless.

On it's own though it's not enough - unencrypted traffic could be compromised using a man-in-the-middle attack where the information sent between two computers actually passes through a third, that transparently reads the informatin and prentends to each end point that it is the other. To name but one.

Using technology such as CAGs helps because encryption is usually a requirement.

These devices tend to be incredibly secure because they're some form of Linux based operating system with only the necessary ports open. Linux by its very nature tends to be more secure than Windows, but any OS and any appliance may be vulnerable.

I cannot, though, give any real-world experiences I've seen or even heard of of CAGs being sufficiently compromised to the extent that they give attackers control of systems or even direct access to information.
0
 
LVL 3

Author Comment

by:pma111
ID: 37709311
Ok thanks. I was thinking perhaps there may be more running on a citix server than citrix, in which case a vulnerability in "the other" may still provide an attack point?
0
 
LVL 3

Author Comment

by:pma111
ID: 37709408
So citrix is based on linux?
0
 
LVL 25

Expert Comment

by:Tony Johncock
ID: 37709552
Ah no - if you use the Citrix Secure Gateway, then this installs over Windows and uses IIS, so yes you have a higher attack profile.

However, the Citrix Access Gateway and NetScaler products are hardened, cut-down Linux variants so don't have this issue. These are appliances - physical devices, although the CAG VPX is a virtual appliance and can be installed on the likes of XenServer (virtualisation hypervisor)
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Sonicwall blocks a site 49 77
Securing a laptop that travels frequently 21 87
Securing Azure Oracle instance of Linux VM 4 58
Domain admin accounts get locked out 35 59
Enterprise Password Manager Suites as well as Local Password managers are covered in this article.
With healthcare moving into the digital age with things like Healthcare.gov, the digitization of patient records and video conferencing with patients, data has a much greater chance of being exposed than ever before.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question