topic Re: DTLS Amplification DDoS Attack on Citrix ADC and Citrix Gateway in Firewall and Security Management

DTLS Amplification DDoS Attack on Citrix ADC and Citrix Gateway

Sigbjorn — Fri, 08 Jan 2021 13:17:17 GMT

Hi,

I'm sure you're all aware of this attack by now, more details can be found on Citrix webpage: https://support.citrix.com/article/CTX289674

We have upgraded our environments and enabled "Hello Verify Request", but even so, there amount of actors attempting to abuse this is filling our connection tables and causing issues for our legitime traffic.

Disabling DTLS altogther seems like the best solution so far, as they give up faster, but we still see connection spikes from time to time and would like to know how we can handle it better.

Are there any IPS signatures, or other ways to throttle the udp/443 traffic from the threat actors abusing this?

Re: DTLS Amplification DDoS Attack on Citrix ADC and Citrix Gateway

PhoneBoy — Tue, 12 Jan 2021 02:17:58 GMT

You can definitely rate limit these inbound connections using fw samp/sam erdos or similar.
Other than that, I'm not aware of a specific action you can take here.

Re: DTLS Amplification DDoS Attack on Citrix ADC and Citrix Gateway

Chris_Atkinson — Tue, 12 Jan 2021 09:04:27 GMT

Geo policy/blocking might also help depending on the specific origins of what you're seeing.