Citrix Devices Are Being Abused as DDoS Attack Vectors (zdnet.com) 17
Threat actors have discovered a way to bounce and amplify junk web traffic against Citrix ADC networking equipment to launch DDoS attacks. From a report: While details about the attackers are still unknown, victims of these Citrix-based DDoS attacks have mostly included online gaming services, such as Steam and Xbox, sources have told ZDNet earlier today. The first of these attacks have been detected last week and documented by German IT systems administrator Marco Hofmann. Hofmann tracked the issue to the DTLS interface on Citrix ADC devices. DTLS, or Datagram Transport Layer Security, is a more version of the TLS protocol implemented on the stream-friendly UDP transfer protocol, rather than the more reliable TCP. Just like all UDP-based protocols, DTLS is spoofable and can be used as a DDoS amplification vector.
2021. The Year Of Digital Rape (Score:2)
Guess 2021 is going to be a bad year for our digital lives.
Re: (Score:3)
2021: The Year of RFC1149.
Initial session setup (Score:3, Insightful)
Even though it's UDP, the client should *always* have to send more data to begin with to the server which *always* should return smaller replies during session setup.
This should include padding with nulls '0's or whatever floats your boat and the server should check that the client has sent an 'abundant' amount of data for it to send it's smaller reply.
Once authenticated and whatever then you can go back to business as usual with 'ratelimiting'.
That should sort out amplification attacks easily enough.
Re: (Score:2)
Even though it's UDP, the client should *always* have to send more data to begin with to the server which *always* should return smaller replies during session setup.
DTLS provides a similar mechanism during session setup that TCP offers to prevent one-sided spoofing. You don't even have to be careful about how you design your protocol.
You just have to have the minimum competence necessary to use a feature already provided to you by your TLS stack.
I think missed a word (Score:2)
Maybe it's because english is not my primary language, or maybe it's the coffee that hasn't kicked in yet, but "a more version" sounds like nonsense.
Re: (Score:2)
You are correct on this, it isn't your English skills in question, but the writer of this content.
Re: (Score:2)
what does this have to do with the topic? These systems run on a modified FreeBSD kernel...
Re: (Score:1)
Citrix has always been and always will be a Windows shop doncha know.
Re: (Score:3)
I used to work for Citrix and Netscaler, the company they acquired for this product. Just because most of the products people think of from Citrix are Windows based doesn't mean everything is.
Re: (Score:3)
Citrix has always been and always will be a Windows shop doncha know.
Not exactly true. Citrix began as an OS/2 product and was designed to be platform agnostic.
It's just that almost no one wanted it outside of Windows shops. I don't know if anyone still uses Citrix for Unix hosts. There were never many deployments.
https://en.wikipedia.org/wiki/... [wikipedia.org]
https://docs.citrix.com/en-us/... [citrix.com]
Re:Everything Windows touches (Score:5, Funny)
Apparently, Windows is so awful that it's mere existence causes vulnerabilities to leech into other operating systems and software.
Re: (Score:3)
Correct.
Re: (Score:1)
Re: (Score:2)
Oh wait, I get it!
It's Funny because it's True!
(Haven't had my coffee yet.)
Re: (Score:2)
Everything Windows touches turns to shit.
From the downmods it's clear that Microsoft employees still hang out on Slashdot and are still basically evil. The only difference from the cancer years? Older, uglier, less competent, exactly as toxic. Because you are the guy who didn't leave.
DTLS is not the problem (Score:3)
It's brain-damaged implementations that fail to use DTLS's stateless cookie feature designed specifically to prevent these types of problems from occurring in the first place.
Then we have commentary from people who should know better:
"If the DTLS interface is needed, forcing the device to authenticate incoming DTLS connections is recommended, although it may degrade the device's performance as a result.
If you are making use of Citrix ADC and have enabled DTLS/EDT (UDP via port 443) you might need to run this command: "set ssl dtlsProfile nsdtls_default_profile -helloVerifyRequest ENABLED". This will prevent you from future UDP amplification attacks"
This is essentially the exact same thing as deploying a system with TCP SYN cookies disabled and justifying such rank insanity by proclaiming it degrades the device's performance.
"Actually the vast majority of deploys will become unstable with that. To be safe until January, better block UDP. "
Good grief.