Citrix confirms ongoing DDoS attack impacting NetScaler ADCs

guest · Dec 24, 2020

Citrix confirms ongoing DDoS attack impacting NetScaler ADCs
December 24, 2020
https://www.bleepingcomputer.com/ne...ongoing-ddos-attack-impacting-netscaler-adcs/

Citrix has confirmed today that an ongoing 'DDoS attack pattern' using DTLS as an amplification vector is affecting Citrix Application Delivery Controller (ADC) networking appliances with EDT enabled.

Reports of the attack have started trickling in on December 21st, with customers reporting an ongoing DDOS amplify attack over UDP/443 against Citrix (NetScaler) Gateway devices.
Small number of customers affected
"As part of this attack, an attacker or bots can overwhelm the Citrix ADC DTLS network throughput, potentially leading to outbound bandwidth exhaustion," the company explained in a threat advisory published earlier today.
Click to expand...

Update to remove attack vector under development

"Citrix is working on a feature enhancement in DTLS to eliminate the susceptibility to this attack," the company added.
"Citrix expects to have this enhancement available on the Citrix downloads page for all supported versions on Jan 12, 2021."

Customers impacted by this DDoS attack can temporarily mitigate it by temporarily disabling DTLS, the amplification vector used by the attackers.
Click to expand...

guest · Jan 4, 2021

Citrix adds NetScaler ADC setting to block recent DDoS attacks
January 4, 2021
https://www.bleepingcomputer.com/ne...ler-adc-setting-to-block-recent-ddos-attacks/

Citrix has released a feature enhancement designed to block attackers from using the Datagram Transport Layer Security (DTLS) feature of Citrix ADC and Gateway devices as an amplification vector in DDoS attacks.

According to reports that have surfaced starting with December 21st, 2020, a DDOS attack used DTLS to amplify traffic from susceptible Citrix ADC devices dozens of times.

"As part of this attack, an attacker or bots can overwhelm the Citrix ADC DTLS network throughput, potentially leading to outbound bandwidth exhaustion," the company said in an advisory published on December 24th.
Click to expand...

Fix now available
Citrix has now released a feature enhancement to remove the amplification vector on NetScaler ADC devices with Enlightened Data Transport UDP Protocol (EDT) enabled.

The company's newly released DTLS feature enhancement adds a "HelloVerifyRequest" setting that will address the susceptibility to this attack vector and will block attempts made by attackers to abuse them in future DDoS attacks.
Click to expand...

Log in or Sign up

Citrix confirms ongoing DDoS attack impacting NetScaler ADCs

guest Guest

guest Guest

Log in or Sign up

Citrix confirms ongoing DDoS attack impacting NetScaler ADCs

guest Guest

guest Guest

Useful Searches