Citrix Bleed represents a “huge early Christmas present” for the cyber criminals who exploited the vulnerability and will likely continue to pose a potent threat globally in 2024, a security expert has told ITPro.
The vulnerability, which has affected hundreds of organizations globally since it was discovered in October 2023, claimed another victim this week after US telecoms firm Xfinity confirmed it had experienced a data breach.
Xfinity, which relies on Citrix for cloud services, revealed hackers gained unauthorized access to their internal systems between the 16th and 19th of October, and customers have been warned that “information was likely acquired”.
Though Xfinity had taken steps to patch systems following Citrix Bleed, a subsequent investigation found that threat actors had already taken advantage of the vulnerability prior to their updates.
The information acquired includes names, contact details, usernames, passwords, and even the last four digits of some social security numbers.
“We know that you trust Xfinity to protect your information, and we can’t emphasize enough how seriously we are taking this matter,” Xfinity said in a statement.
“We remain committed to continue investing in technology, protocols and experts dedicated to helping to protect your data and keeping you, our customer, safe.”
Citrix Bleed continues to cause problems
Despite the issuing of a patch, Citrix Bleed has remained problematic. The vulnerability allows threat actors to bypass multifactor authentication (MFA) and hijack authenticated sessions.
That's why Xfinity is asking customers to set up their own two-factor or multi-factor authentications to help protect individual accounts at the ground level.
Akhtar said that the vulnerability is among the most disturbing and disruptive to emerge in recent years and will likely continue to cause problems for organizations well into 2024.
“Citrix is a huge provider of cloud computing services,” he said.
“It's used by 99% of the Fortune 100, and 98% of the Fortune 500. So any breach has the potential to allow cyber criminals access to hundreds of thousands of organizations across the globe.
"Xfinity is a perfect example of this. It’s the largest provider of cable internet access in the United States, meaning any breach could affect millions of Americans. In other words, the Citrix Bleed had the potential to be a huge early Christmas present for the cyber criminals who exploited the vulnerability."
Discover why it is essential to use zero trust architecture to secure cloud workloads
A key concern in any breach of this kind, Akhtar added, is the potential domino effect it creates further down the supply chain. Previous breaches this year, such as the MOVEit breach, impacted hundreds of organizations globally.
This has spurred a heightened focus on supply chain security among many organizations, he added, with security practitioners remaining highly vigilant of potential threats.
“89% of companies have experienced a supplier risk event in the past five years and that’s in large part down to the interconnectedness of modern business” said Akhtar.
“This breach is a perfect illustration of how an unpatched vulnerability in a supplier’s software has the potential to spiral out of control.”
