If multi-billion dollar software giant Citrix can let a major hack go under its radar, what hope is there for you? – that seems to be the message behind the latest cyber security attack, in which Russian hacker group w0rm claims to have been able to gain access to the content management system on the Citrix network via an insecure password.
W0rm has previously offered to sell stolen data from the Wall Street Journal, BBC, Adobe, Vice and CNET, but also runs legitimate penetration testing, putting it somewhere between a blackhat and whitehack hacker. It claims to have undertaken the Citrix hack for altruistic reasons, using its powers to expose the security flaws of big networks.
> See also: Dangerous liaisons: how the Ashley Madison hack ended the age of innocence in cyber security
The hack took place in October and was exposed by security firm Cyberint in Israel, but Elad-Ben Meir, Cyberint's vice president of marketing, told SC Magazine the company failed to respond to repeated attempts to notify it. The hackers themselves also tweeted Citrix with a link to its blog post (in Russian) and received no response.
The group was able to exploit a series of security holes to gain access to the company's administrative system, including the remote assistance system, potentially giving it remote access to thousands of customers' endpoints.
Those endpoints could then be used to steal sensitive information or to hijack as a botnet to run DDoS attacks.
'The truly disturbing thing about this incident is that it shows how easily even very reputable external IT contractors, on whom companies rely to protect their data in the cloud, are vulnerable,' said Meir.
> See also: Go hack yourself: what is white hat hacking and why are businesses turning to it?
Tony Pepper, CEO of security specialist Egress Software, said the incident prompts questions about organisations' ability to effectively deploy information security measures across their business.
'Furthermore, with new EU regulations now promising to enforce mandatory data breach reporting for all companies, with fines reaching 4% of global revenues for those found in breach, companies need to act now to protect all customer data or else face the consequences,' said Pepper.
