FBI warns companies about hackers increasingly abusing RDP connections. Not too many of us knows the full meaning of RDP so, we are going to explain it in a brief for you to understand what this warning is all about.<\/p>\n
RDP is an acronym which means remote desktop protocol and is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. The user employs\u00a0RDP\u00a0client software for this purpose, while the other computer must run\u00a0RDP\u00a0server software.<\/p>\n
In a public service announcement published on the 27th of September 2018 by the US Federal Bureau of Investigation\u2019s (FBI) Internet Crime Complaint Center (IC3), the FBI is warning companies about the dangers of leaving RDP endpoints exposed online.<\/p>\n
RDP stands for the Remote Desktop Protocol, a proprietary technology developed by Microsoft in the 90s that allows a user to log into a remote computer and interact with its OS via a visual interface that includes mouse and keyboard input \u2013hence the name \u201cremote desktop.\u201d<\/p>\n
RDP access is rarely enabled on home computers, but it\u2019s often turned on for workstations in enterprise networks or for computers located in remote locations, where system administrators need access to, but can\u2019t get to in person.<\/p>\n
In its\u00a0alert, the FBI mentions that the number of computers with an RDP connection left accessible on the Internet has gone up since mid and late 2016.<\/p>\n
This assertion from the FBI correlates with numbers and trends reported by cyber-security firms in the past few years. For example, just one company, Rapid7, reported seeing nine million devices with port 3389 (RDP) enabled on the Internet in early 2016, and that number rose to\u00a0over 11 million by mid-to-late 2017.<\/p>\n
Hackers, too, read cyber-security reports. Early warnings from the private sector about the increasing number of RDP endpoints caught hackers\u2019 attention long before sysadmins.<\/p>\n
For the past few years, there has been a constant stream of incident reports in which investigators found that hackers got an initial foothold on victims\u2019 networks thanks via a computer with an exposed RDP connection.<\/p>\n
Nowhere has this been more the case than in ransomware attacks. Over the past three years, there have been tens of ransomware families that were specifically designed to be deployed inside a network after attackers gained an initial foothold, which in many cases ended up being an RDP server.<\/p>\n
Ransomware specifically designed to be deployed via RDP includes strains such as CryptON, LockCrypt, Scarabey, Horsuke, SynAck, Bit Paymer, RSAUtil, Xpan, Crysis, Samas (SamSam), LowLevel, DMA Locker, Apocalypse, Smrss32, Bucbi, Aura\/BandarChor, ACCDFISA, and Globe.<\/p>\n
Here\u2019s just one user\u00a0recounting one event on Reddit\u00a0where hackers broke in via RDP and launched ransomware that encrypted countless of his systems.<\/p>\n
There are three ways in which hackers usually tend to get in. The easiest way is when sysadmins enable RDP access on a server and don\u2019t set up a password. Anyone accessing that computer\u2019s IP address on port 3389 will be prompted by a login screen where they can log in just by pressing Enter.<\/p>\n
The second way is derived from the first but requires on attackers either guessing login credentials (via a brute-force attack) or by using precompiled lists of common username-password combos (via dictionary attacks).<\/p>\n
The third method also relies on mass-scanning the internet, but instead of guessing credentials, attackers deliver exploit code for known vulnerabilities in the RDP protocol. If the port is exposed, then hackers can exploit it.<\/p>\n
According to Rapid7, between 2002 and late early 2017, there have been 20 Microsoft security updates specifically related to RDP, updates that fixed 24 major vulnerabilities. Patches for RDP continued even after Rapid7 stopped counting, with the latest of these fixes being deployed this March for a\u00a0flaw in CredSSP, one of the smaller protocols part of the RDP package.<\/p>\n
In an interview with ZDNet about the FBI\u2019s alert, Mark Dufresne, VP, Threat Research and Prevention at cyber-security Endgame, shared some of his dealings with the RDP threat.<\/p>\n
\u201cRDP has been baked into Windows for a very long time and has been abused by attackers since it became widely deployed,\u201d Dufresne told ZDNet.<\/p>\n
\u201cWe can look at sources like greynoise.io to see that attackers are constantly looking for open RDP connections,\u201d he added. \u201cAlmost a thousand unique IPs were looking for RDP services listening on the default port each day over the past week.\u201d<\/p>\n
Once attackers get in, it\u2019s all fair game, unless they\u2019re not careful and security products expose their presence.<\/p>\n
But not all RDP compromises result in ransomware infections, data theft, or malicious behavior. Some of the people behind these RDP scans don\u2019t always exploit the hacked systems \u2013at least not directly\u2013 and stockpile hacked RDP endpoints to sell online.<\/p>\n
Since mid-2016, just about when cyber-security firms were noting a rise in RDP servers, a group of hackers set up\u00a0xDedic, a web portal where they and other criminals could sell or buy these hacked and hoarded RDP systems.<\/p>\n
Initially, it was said that xDedic provided crooks access to over 70,000 hacked RDP endpoints, but one year later, despite the media attention and attempts to take down the site, xDedic\u2019s RDP server pool had gone\u00a0up to 85,000.<\/p>\n
But xDedic was only the beginning. Other copycat \u201cRDP shops\u201d \u2013as they became to be known as\u2013 popped up everywhere. This reporter has been tracking some of these services for the past few years on Twitter [1,\u00a02,\u00a03,\u00a04,\u00a05,\u00a06].<\/p>\n
The most recent of these was discovered just this summer,\u00a0in July. McAfee security researchers found it peddling access to RDP workstations located on some pretty sensitive places such as airports, government, hospitals, and nursing homes.<\/p>\n
But these shops wouldn\u2019t be a problem unless people stopped exposing RDP endpoints altogether. Through its alert, the FBI is now urging companies to secure these systems before it\u2019s too late and they get hacked.<\/p>\n
Together with the Department of Homeland Security, the two agencies have published today the following advice in regards to improving RDP security.<\/p>\n","protected":false},"excerpt":{"rendered":"
FBI warns companies about hackers increasingly abusing RDP connections. Not too many of us knows the full meaning of RDP so, we are going to explain it in a brief for you to understand what this warning is all about. RDP is an acronym which means remote desktop protocol and is a proprietary protocol developed […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-46","post","type-post","status-publish","format-standard","hentry","category-tech-news"],"yoast_head":"\n