Tag Info

New answers tagged

1

Also note that there are two ways to mitigate this: If you have the Web App Firewall feature on your NetScaler (Platinum Edition or Enterprise with the WAF license) we have a WAF Signature that can be downloaded from the website: https://www.citrix.com/downloads/netscaler-adc/components/application-signature-protection-for-shellshock-vulnerability For ...


2

I remember a case (but not the name of the case) where malware would periodically send blank http requests to big and reliable websites to get a reliable UTC, the malware was designed with a timed bomb on it, set to Denial of Service a specified site at a certain date/time.


0

Here's the official statement... http://support.citrix.com/article/CTX200217 Citrix NetScaler ADC and NetScaler Gateway We are not currently aware of any direct risk from this issue to the main traffic path for NetScaler vServer endpoints. Some risk may exist for management interfaces so, in line with existing best practice, we recommend that access to ...


1

Netscalers appear to be vulnerable! Netscaler is running GNU bash, version 2.05b.0(1) , which is stated as vulnerable in http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271 Here is what I get: root@ns# env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test root@ns# Response from Citrix on the ticket I raised: ...


12

Simple connection testing is one reason why malware might connect to Google, Yahoo and other search engines, but I would like to present a different explanation. One frequent application for botnets is search engine spam optimization. As you might notice, the result page of Google (and most other search engines) doesn't lead to the results directly, but ...


6

I'm just guessing here. But it would provide an alternative solution to the problem of name resolution to use a search engine instead of DNS to find a CnC server or to poll for updates and campaigns. It's not clear from the web page if it were simply hitting the front page or running a query - and I don't have tools here to read the pcap files myself. Even ...


60

Most likely, it's just trying to check if there's a working internet connection. The malware authors assume that: Google (or other Alexa Top-1M sites) will be up 99.999% of the time. Traffic going to common productivity sites like Google will not be flagged as unusual. You (or your network administrator) will be unlikely to have blocked these sites at the ...



Top 50 recent answers are included