Password spraying attacks directed at various organizations worldwide

Password spraying attacks directed at various organizations worldwide

Samana Group LLC Samana Group LLC

Samana Group LLC

Samana Group provides virtual workspaces, and services for virtual environments.

发布日期: 2024年12月13日
+ 关注

Cloud Software Group is aware of a recent series of password spraying attacks directed at various organizations around the globe. Some of these attacks have targeted NetScaler appliances.

Cloud Software Group has collaborated with affected customers to analyze the issues and recommends the following mitigations:

  • Ensure that multi-factor authentication is enabled for Gateway and the MFA verification factor is configured before the LDAP factor, details for which can be found here.
  • Create a responder policy to allow requests only for desired FQDN, as attacks are frequently targeting IP addresses rather than Gateway FQDNs. Create the following responder policy:

  1. add responder policy IP_Block “HTTP.REQ.HOSTNAME.EQ(\”<enter gateway FQDN here>\”).NOT” DROP
  2. bind vpn vserver Gateway_vServer -policy IP_Block -priority 100

  • Create a responder policy to block the following end points if not utilizing historic pre-nFactor basic/classic authentication:

  1. /cgi/login
  2. /p/u/doAuthentication.do
  3. /p/u/getAuthenticationRequirements.do

We recommend that you review the CSG Post and follow the recommendations.

要查看或添加评论，请登录

Samana Group LLC的更多文章

社区洞察

其他会员也浏览了