Infosec in brief On August 29, the US Federal Emergency Management Agency fired its CISO, CIO, and 22 other staff for incompetence but insisted it wasn't in response to an online attack. New material suggests FEMA's claim may be false. According to DHS Secretary Kristi Noem, an audit found serious security problems at FEMA and revealed that "entrenched bureaucrats" had lied about the agency's security preparedness. "These deep-state individuals were more interested in covering up their failures than in protecting the Homeland and American citizens' personal data, so I terminated them immediately," she said. Crucially, Noem said no data had been lost but it appears that's not the case. According to a presentation passed to Nextgov, attackers broke into FEMA in June using stolen credentials to access a Citrix system. The attackers then uploaded data from FEMA's Region 6 servers, covering Arkansas, Louisiana, New Mexico, Oklahoma, and Texas. According to the documents, FEMA didn't discover the attack until July. By July, the Cybersecurity and Infrastructure Security Agency was telling agencies to patch against so-called CitrixBleed 2 attacks that exploited a CVSS 9.3 bug in Netscaler's ADC and Gateway platforms that would allow miscreants to steal sensitive data such as session tokens and bypass multi-factor authentication. There were warnings that the bug was being exploited back in June, but it seems they weren't heeded. Now, it appears, FEMA's IT department is getting a compl...
Germany blames Fancy Bear for 2023 hacking campaign
Affected Software
Frequently Asked Questions
What did the reported FEMA incident involve?
According to a presentation passed to Nextgov, attackers used stolen credentials in June to access a Citrix system and uploaded data from FEMA Region 6 servers. The affected region covers Arkansas, Louisiana, New Mexico, Oklahoma, and Texas.
When was the alleged FEMA intrusion discovered?
The documents reportedly state that FEMA did not discover the attack until July, after the alleged June access.
Was data loss confirmed by FEMA?
DHS Secretary Kristi Noem said that no data had been lost. However, the presentation described attackers uploading data from FEMA servers, creating a conflict with that claim.
What Citrix issue was associated with the reported activity?
By July, the Cybersecurity and Infrastructure Security Agency was telling agencies to patch against CitrixBleed 2 attacks exploiting a CVSS 9.3 vulnerability in Netscaler.
What personnel action did FEMA take?
On August 29, FEMA fired its CISO, CIO, and 22 other staff for incompetence, while insisting the action was not in response to an online attack. Noem said an audit identified serious security problems and false statements about the agency's preparedness.