By
Citrix has confirmed today that an ongoing 'DDoS attack pattern' using DTLS as an amplification vector is affecting Citrix Application Delivery Controller (ADC) networking appliances with EDT enabled. Datagram Transport Layer Security (DTLS) is a communications protocol for securing delay-sensitive apps and services that use datagram transport. DTLS is based on the Transport Layer Security (TLS) protocol and it is designed to prevent eavesdropping and tampering, and to protect data privacy. Reports of the attack have started trickling in on December 21st, with customers reporting an ongoing DDOS amplify attack over UDP/443 against Citrix (NetScaler) Gateway devices. Small number of customers affected
"As part of this attack, an attacker or bots can overwhelm the Citrix ADC DTLS network throughput, potentially leading to outbound bandwidth exhaustion," the company explained in a threat advisory published earlier today. "The effect of this attack appears to be more prominent on connections with limited bandwidth." The scope of the attack is limited to just "a small number of customers" at the moment according to Citrix and it impacts all ADCs with Enlightened Data Transport UDP Protocol (EDT) enabled. Furthermore, based on current evidence there are no known Citrix vulnerabilities being actively exploited in this ongoing attack. If information on products vulnerable to DDoS attacks due to software bugs is discovered during this investigation, it will be published by the Citrix Security Response Team in a separate security advisory. It seems a worldwide UDP:443 (EDT) DDOS attack against #NetScaler #gateway is active since last night. I found these source IP addresses of the attackers in my nstraces:
45.200.42.0/24
Update to remove attack vector under development
"Citrix is working on a feature enhancement in DTLS to eliminate the susceptibility to this attack," the company added. "Citrix expects to have this enhancement available on the Citrix downloads page for all supported versions on Jan 12, 2021." Customers impacted by this DDoS attack can temporarily mitigate it by temporarily disabling DTLS, the amplification vector used by the attackers. To disable DTLS on your Citrix ADC you will have to issue the following command from the command line interface:
set vpn vserver -dtls OFF
"Disabling the DTLS protocol may lead to limited performance degradation to real time applications using DTLS in your environment," Citrix added. "The extent of degradation depends on multiple variables. If your environment does not use DTLS, disabling the protocol temporarily will have no performance impact." Customers who can't immediately disable DTLS in their environment are advised to reach out to Citrix Technical Support.

Citrix confirms ongoing DDoS attack impacting NetScaler ADCs

The Cyber-Avengers Protecting Hospitals From Ransomware

ASD notified Defence and its recruitment database contractor that it had reason to believe it was vulnerable to a Netscaler bug a month after Citrix made the vulnerability public. Screenshot: Chris Duckett/ZDNet
The Australian Signals Directorate (ASD) has revealed that a vulnerability in Citrix, announced over Christmas , could have been used by malicious actors to access a database of Australian Defence recruitment details. "On the 24th of January ... through sensitive other sources, had a concern that the Department of Defence and its contractor running the DFRN [Defence Force Recruiting Network] may have been vulnerable to a malicious act as a result of the Citrix issue," newly installed director-general of the Australian Signals Directorate Rachel Noble told Senate Estimates on Wednesday night. Noble added that ASD believed no data was compromised, but it did see attempts to access the network related to the vulnerability. "Given the global nature of the vulnerability which affected companies worldwide, I don't think they would have been the only one," Noble said. As reported by the ABC on Wednesday morning, the DFRN was offline and quarantined for 10 days from February 2 to February 12. A source told the ABC the issue was detected before Christmas and crisis meetings were held twice a day over the issue. The database was run by ManpowerGroup, the ABC reported. The director-general said there was no actor in particular behind the issue. "What we saw from a holistic global point of view from the Australian Cyber Security Centre is that, a vulnerability in Citrix which is used globally, becomes known on 25th of December 2019. We saw a huge number of all sorts of actors then try to exploit that vulnerability with a large number of companies and government departments," she said. Under questioning from ALP Senate leader Penny Wong, Noble was not concerned by the delay within Defence from being notified of the issue on January 24th, to taking the database offline a week later. "We see this all the time for organisations, a week or so to understand what's really happened on their network and get to the detail," Noble said. "I think in this instance, on the second of February, the decision by Defence with its contractor was taken through an abundance of caution." For an agency shrouded by secrecy, the ASD was more forthcoming than Defence department officials at the Estimates table, who admitted the database was full of personal information such as health information, medical exams, and psychological information. "This particular network that we are talking about here for the Defence Force recruiting is an external network, not part of the Defence network," Defence CIO Stephen Pearson said. Pearson said he was unaware if DXC, ManpowerGroup's service provider, ever applied the patches issued by Citrix on January 20. "I do not know that date they applied their patch," he said. Noble said earlier to Estimates that since July 1 of last year, ASD receives on average five incident reports a day, and one cyber crime report every 10 minutes

Citrix vulnerability used for potential Defence recruitment database access

Reseller News
Citrix rolls out all NetScaler vulnerability patches
Citrix CIO "strongly" urges all customers to install the fixes immediately
Citrix has completed its patch release timeline for NetScaler vulnerability (CVE-2019-19781) across its affected products. Released on January 25, permanent fixes are available for Citrix Application Delivery Controller (ADC) version 10.5 to address the vulnerability. This release follows fixes for ADC and Citrix Gateway versions 11.1, 12.0, 12.1 and 13.0 and Citrix SD-WAN 4000-WO, 5000-WO, 4100-WO and 5100-WO which were made available over the last week. These fixes are available to all customers even if they don’t have an active maintenance contract with Citrix. Fermin J. Serna, chief information security officer at Citrix, said in a blog post he “deeply regret[s]” the impact of the vulnerability on customers. “Customer security is a top priority for Citrix, and we remain fully committed to ensuring that all customers remediate their systems for the CVE-2019-19781 vulnerability,” Serna said. “To that end, we will keep all enhanced customer support measures in place for as long as necessary. “We strongly urge all customers to immediately install these fixes.”
If left unpatched, the vulnerability can lead to arbitrary code execution by malicious users. This release aligns with  Citrix’s expedited patch timeline , which estimated a 25 January completion date. Serna added that customers should also use the Indicator of Compromise Scanning tool , developed in collaboration with FireEye Mandiant, which can identify potential CVE-2019-19781 vulnerabilities in systems. Interested users can access the tool via Citrix’s GitHub repository.

Wells Fargo Success Story

3M Success Story

Platform Overview

NetScaler

Work for NetScaler?

Compete with NetScaler?

Work for NetScaler?

Discover the right solution for your team