London, December 12, 2023— As spyware, ransomware and other malicious actors plunder those companies affected by the Citrix Bleed vulnerability, SentryBay show how clients can be protected from this and other similar attacks to VDI infrastructure.
The Citrix Bleed allows an attacker to steal session tokens from Netscaler, circumvent all authentication methods (including MFA) and use these tokens in a replay attack. The vulnerability provides an authenticated connection to allow further ransomware or spyware attacks. This has been illustrated by ransomware attacks by LockBit on defence organisations such as Boeing, governments, health organisations and multiple credit unions.
The remediations Citrix are implementing close this particular vector, however compromised companies may have the door left open for further attacks with malicious actors hiding code to allow back door access. Implementing certificate-based authentication will mitigate further breaches with a stolen token or through authentication by-pass vulnerabilities, but this is not easy to implement on unmanaged devices.
SentryBay’s unique enforcement mechanism (part of the Armored Client) authenticates devices before a user attempts entry using the normal authentication methods – which thwarts attackers harnessing the vulnerability. It also easily ensures that all personnel, even BYO and third-party contractors on unmanaged devices, can securely access corporate assets.
“SentryBay have a long track history of securing the VDI and DaaS systems of the most security conscious financial institutions, governments and professional service firms, all companies for whom data integrity is paramount,” said Marcus Whittington, Co-Founder and COO, SentryBay. “Proactively protecting all data in a VDI session is a key pillar of our unique protection – but it’s been SentryBay’s enforcement mechanisms that has been the key to avoid the impact of Citrix Bleed.”
The same additional token authentication can be used for AVD/W365, VMware, AWS Workspaces and other VDI tools, to further protect those systems.
SentryBay’s Armored Client provides zero-day safeguards to block unknown threats by closing down system vulnerabilities. The enforcement mechanism not only addresses current threats like Citrix Bleed but also bolsters a company’s defense in depth, zero-trust architecture. By providing additional access controls, even in the unmanaged world, Armored Client ensures every device and user that interacts with the network is authorized to do so. It then protects all data entered into that session from keylogging, screen capture and malicious DLL injection.
-ends-
About SentryBay
SentryBay is a pioneer in technology that approaches security issues from a different – and more proactive – perspective. Endpoint data protection is essential to provide a secure, cloud-based IT ecosystem that avoids the weaknesses inherent in both technology and users. SentryBay’s blend of technologies – underpinned by multi-layered anti-keylogging technology – allows these weaknesses to be overcome. The company’s product is used by some of the world’s largest enterprises – from global FIs to small, medium, and large enterprises across all verticals.
Media Contact:
Marcus Whittington, [email protected]
