Comments on: CITRIX: Owning the Legitimate Backdoor http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/ Information Security Think Tank Fri, 29 Aug 2008 18:53:50 +0000 http://wordpress.org/?v=2.6.1 By: ikkuhqhp http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-122075 ikkuhqhp Sun, 18 May 2008 09:57:47 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-122075 pdp, I was reading this post but found that the youtube link doesn't work. Could you explain "escaping windows GUI" again please? pdp, I was reading this post but found that the youtube link doesn’t work. Could you explain “escaping windows GUI” again please?

]]> By: Citrix Prezantasyon Sunucusu için Yama | Virüs Güvenlik Haberleri http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-86876 Citrix Prezantasyon Sunucusu için Yama | Virüs Güvenlik Haberleri Sat, 15 Dec 2007 10:17:36 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-86876 [...] güvenlik açığı duyurusu: http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/ Citrix güvenlik bülteni: [...] [...] güvenlik açığı duyurusu: http://www.gnucitizen.org/blog.....-backdoor/ Citrix güvenlik bülteni: [...]

]]> By: TesCitrixOuPas » Blog Archive » Citrix, trou de sécurité ou mauvaise gestion des administrateurs Citrix ? http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-78422 TesCitrixOuPas » Blog Archive » Citrix, trou de sécurité ou mauvaise gestion des administrateurs Citrix ? Wed, 28 Nov 2007 22:03:02 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-78422 [...] le site GNUCITIZEN, un chercheur en sécurité en faisant une simple recherche sur Google est tombé sur une floppé [...] [...] le site GNUCITIZEN, un chercheur en sécurité en faisant une simple recherche sur Google est tombé sur une floppé [...]

]]> By: newKid http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-73277 newKid Mon, 19 Nov 2007 03:30:40 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-73277 I am not a hacker, just a college kid, studying networking, programming, security, the like. I am researching Citrix for a security paper. I clicked on some of these links, to see what would happen, as the read is seriously intriguing to me. Most of them you can't actually get to. One came up but gave me an error and did not display. Please explain; are you telling me that by clicking the links that are returned in the search, that you are actually accessing information running on the server? There is no one on the other end that can see or be alerted of the fact that some remote user is actually getting in unauthenticated? I don't understand. How does this actually work out? I am not a hacker, just a college kid, studying networking, programming, security, the like. I am researching Citrix for a security paper. I clicked on some of these links, to see what would happen, as the read is seriously intriguing to me. Most of them you can’t actually get to. One came up but gave me an error and did not display. Please explain; are you telling me that by clicking the links that are returned in the search, that you are actually accessing information running on the server? There is no one on the other end that can see or be alerted of the fact that some remote user is actually getting in unauthenticated? I don’t understand. How does this actually work out?

]]> By: pdp http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-63063 pdp Tue, 30 Oct 2007 07:21:04 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-63063 Intrigued, absolutely! Intrigued, absolutely!

]]> By: Intrigued http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-62957 Intrigued Tue, 30 Oct 2007 00:56:30 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-62957 I found it interesting that some of the servers have user names and domain names in the config files. After looking around I found that some of them give you a remote desktop without authentication with full access by using a user name and domain name (could be dead wrong and it just gives you the remote desktop anyways but none the less its still a blatant hole) I found it interesting that some of the servers have user names and domain names in the config files. After looking around I found that some of them give you a remote desktop without authentication with full access by using a user name and domain name (could be dead wrong and it just gives you the remote desktop anyways but none the less its still a blatant hole)

]]> By: Network Security Podcast, Episode 81 | securosis.com http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-59431 Network Security Podcast, Episode 81 | securosis.com Thu, 18 Oct 2007 16:23:42 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-59431 [...] Citrix; Owning the legitimate backdoor [...] [...] Citrix; Owning the legitimate backdoor [...]

]]> By: Bbb http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58567 Bbb Mon, 15 Oct 2007 15:06:32 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58567 Absolutely very concerning, the fact that you can get Numb-Nut administrators. As I mentioned above.... http://search.yahoo.com/search.....ension:rdp http://www.google.com/search?q=ext:rdp .....you get the same numb-nuts administrating plain old Terminal services as well as any other product. The first line of your article 'The Internet is full of wide open CITRIX gateways' probably put the Sh$ts up many a CITRIX administrator because they implement true CITRIX gateways (that only open for the correct people). I hope people reading this article realise that this is not the way to implement CITRIX for remote access. I can't believe the amount of people who don't follow simple IT Security recommended practices. This is probably why your article should be entitled 'Beware There are Numb-Nut Administrators everywhere!!' ;-) Bbb Absolutely very concerning, the fact that you can get Numb-Nut administrators.

As I mentioned above….

http://search.yahoo.com/search…..ension:rdp

http://www.google.com/search?q=ext:rdp

…..you get the same numb-nuts administrating plain old Terminal services as well as any other product.

The first line of your article ‘The Internet is full of wide open CITRIX gateways’ probably put the Sh$ts up many a CITRIX administrator because they implement true CITRIX gateways (that only open for the correct people). I hope people reading this article realise that this is not the way to implement CITRIX for remote access.

I can’t believe the amount of people who don’t follow simple IT Security recommended practices. This is probably why your article should be entitled ‘Beware There are Numb-Nut Administrators everywhere!!’ ;-)

Bbb

]]> By: Citrix holes endanger Government and Military systems - spyware news http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58562 Citrix holes endanger Government and Military systems - spyware news Mon, 15 Oct 2007 14:05:16 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58562 [...] into Citrix GUIs and playing with .ica files. He kindly posted the results of this rampage on his blog. What he did was he tried searching for public .ICAs in google and yahoo and found "tons" [...] [...] into Citrix GUIs and playing with .ica files. He kindly posted the results of this rampage on his blog. What he did was he tried searching for public .ICAs in google and yahoo and found "tons" [...]

]]> By: The Day Today » Blog Archive » Citrix backdoors easy to find http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58560 The Day Today » Blog Archive » Citrix backdoors easy to find Mon, 15 Oct 2007 13:47:37 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58560 [...] gateways, which are often unsecured - allowing a hacker to get a command prompt on the servers. This article explains how, and includes a video showing how to get a command prompt from the calculator [...] [...] gateways, which are often unsecured - allowing a hacker to get a command prompt on the servers. This article explains how, and includes a video showing how to get a command prompt from the calculator [...]

]]> By: pdp http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58528 pdp Mon, 15 Oct 2007 10:02:50 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58528 Bbb, but it is still concerning isn't it? which was the point of the post! right? Bbb, but it is still concerning isn’t it? which was the point of the post! right?

]]> By: Bbb http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58525 Bbb Mon, 15 Oct 2007 09:58:27 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58525 How about 'hacking' Windows Terminal services http://search.yahoo.com/search?p=originurlextension:rdp http://www.google.com/search?q=ext:rdp As mentioned above this isn't a hack just someone who left the front door open for someone to easily walk through How about ‘hacking’ Windows Terminal services

http://search.yahoo.com/search.....ension:rdp

http://www.google.com/search?q=ext:rdp

As mentioned above this isn’t a hack just someone who left the front door open for someone to easily walk through

]]> By: pdp http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58521 pdp Mon, 15 Oct 2007 09:34:54 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58521 the videos can be found at the bottom of this post: http://www.gnucitizen.org/blog/hacking-citrix-the-forceful-way/ the videos can be found at the bottom of this post: http://www.gnucitizen.org/blog.....ceful-way/

]]> By: Alan http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58520 Alan Mon, 15 Oct 2007 09:28:33 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58520 Hack is a hack. Doesn't matter whether you find it sophisticated or not. If you can get to .mil sites with it, that's obviously something critical. i didnt see the video btw, can someone fix the link: <blockquote>This video is no longer available due to a copyright claim by Citrix Systems, Inc.</blockquote> what copyright? :) Hack is a hack. Doesn’t matter whether you find it sophisticated or not. If you can get to .mil sites with it, that’s obviously something critical.

i didnt see the video btw, can someone fix the link:

This video is no longer available due to a copyright claim by Citrix Systems, Inc.

what copyright? :)

]]> By: stupidisasstupiddoes http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58118 stupidisasstupiddoes Sat, 13 Oct 2007 20:58:21 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-58118 Stupid is as stupid does. You can lead a horse, but making it drink is another issue. Secure Gateway and Access Gateway have been available for years. If the Citrix admin is getting away with exposing a Presentation Server in the DMZ, then they deserve to be hacked. Stupid is as stupid does. You can lead a horse, but making it drink is another issue. Secure Gateway and Access Gateway have been available for years. If the Citrix admin is getting away with exposing a Presentation Server in the DMZ, then they deserve to be hacked.

]]> By: Clear | GNUCITIZEN http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57952 Clear | GNUCITIZEN Sat, 13 Oct 2007 12:39:00 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57952 [...] first general misconception is regarding the CITRIX posts. Let’s start with CITRIX: Owning the Legitimate Backdoor, shall we? A lot of GNUCITIZEN’s readers thought that I am showing new attack techniques. No, [...] [...] first general misconception is regarding the CITRIX posts. Let’s start with CITRIX: Owning the Legitimate Backdoor, shall we? A lot of GNUCITIZEN’s readers thought that I am showing new attack techniques. No, [...]

]]> By: pdp http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57869 pdp Sat, 13 Oct 2007 08:44:07 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57869 rjhoward, one word: gateways! make sure that you use nfuse or whatever else you want but just never, ever, expose 1494/UDP/TCP on the Internet. Segment as much as possible. Unfortunately, all this will make your work 100% more intensive. So, there is no space for laziness :) rjhoward, one word: gateways! make sure that you use nfuse or whatever else you want but just never, ever, expose 1494/UDP/TCP on the Internet. Segment as much as possible.

Unfortunately, all this will make your work 100% more intensive. So, there is no space for laziness :)

]]> By: rjhoward http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57669 rjhoward Fri, 12 Oct 2007 19:13:01 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57669 Ok, you have my attention and the attention of everyone in my organization. How can we tighten things up? What is this lazy administrator doing to contribute to the issue and how can I improve? Ok, you have my attention and the attention of everyone in my organization. How can we tighten things up? What is this lazy administrator doing to contribute to the issue and how can I improve?

]]> By: pdp http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57588 pdp Fri, 12 Oct 2007 14:44:09 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57588 Maverick, since it is known for ages.... why didn't you flagged it then? <strong>I am not releasing a new vulnerability!</strong> <div class="message">All I am saying is that there are wide open CITRIX services out there which are susceptible to attack! on government and military facilities btw!!!</div> BTW, what do you define as hacking? Cuz I am tired of listing to people who define reverse engineering and C exploit writing as hacking. That has nothing to do with hacking. That's stupid methodology everyone can learn in a month. There is nothing creative about it! Maverick, since it is known for ages…. why didn’t you flagged it then? I am not releasing a new vulnerability!

All I am saying is that there are wide open CITRIX services out there which are susceptible to attack! on government and military facilities btw!!!

BTW, what do you define as hacking? Cuz I am tired of listing to people who define reverse engineering and C exploit writing as hacking. That has nothing to do with hacking. That’s stupid methodology everyone can learn in a month. There is nothing creative about it!

]]> By: Citrix Internet Gateways - Critical need to lock these down - Harry Waldron - My IT Forums Blog http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57572 Citrix Internet Gateways - Critical need to lock these down - Harry Waldron - My IT Forums Blog Fri, 12 Oct 2007 13:36:44 +0000 http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/#comment-57572 [...]   CITRIX: Owning the Legitimate Backdoor http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/   Hacking CITRIX - the forceful [...] [...]   CITRIX: Owning the Legitimate Backdoor http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/   Hacking CITRIX - the forceful [...]

]]>