The COVID-19 pandemic has prompted many companies to enable their employees to work remotely and, in a large number of cases, on a global scale. A key component of enabling remote work and allowing employees to access internal corporate resources remotely is Remote Desktop Protocol (RDP), which allows communication with a remote system. In order to maintain business continuity, it is very likely that many organizations brought systems online quickly with minimal security checks in place, giving attackers the opportunity to enter them with ease.
RDP is a Microsoft protocol running on port 3389 that can be utilized by users requiring remote access to internal systems. Most of the time, RDP runs on Windows servers and hosts services such as web servers or file servers, for example. In some cases, it is also connected to industrial control systems.
RDP ports are often exposed to the Internet, which makes them particularly interesting for attackers. In fact, accessing an RDP box can allow an attacker access to an entire network, which can generally be used as an entry point for spreading malware, or other criminal activities.
As it can be such a powerful entry vector, McAfee Advanced Threat Research (ATR) has observed many underground markets emerge, offering RPD credentials at relatively low cost. For example, McAfee ATR uncovered access linked to a major international airport that could be bought for only US$10. Since March 2020, the number of exposed RDP ports have increased considerably.
McAfee Advanced Threat Research and the security industry have been aware of the risk of exposed RDP for many years and will continue to raise awareness as part of our global threat monitoring.
In this blog, we will discuss the risks of exposing the RDP protocol and the associated misconfigurations.
RDP Statistics
The number of RDP ports exposed to the Internet has grown quickly, from roughly three million in January 2020 to more than four and a half million in March. A simple search on Shodan reveals the number of RDP ports exposed to the Internet by country.
It is interesting to note that the number of RDP systems exposed is much higher for China and the United States.
Most of the compromised systems using RDP are running Windows Server but we also notice other operating systems, such as Windows 7.
For attackers, access to a remote system can allow them to perform several criminal actions such as:
- Spreading spam: Using a legitimate system for sending spam is very convenient. Some systems are sold especially for this purpose.
- Spreading malware: A compromised system provides a ready-to-use machine for easily distributing malware, or even pivoting to the internal network. Many ransomware authors use this vector to target organizations around the world. Another criminal option would be to implant a cryptominer.
- Using the compromised box as their own: Cybercriminals also use remotely compromised systems to hide their tracks by, for example, compiling their tools on the machine.
- Abuse: The remote system can also be used to carry out additional fraud such as identity theft or the collection of personal information.
This recent increase in the number of systems using RDP over the Internet has also influenced the underground. McAfee ATR has noticed an increase in both the number of attacks against RDP ports and in the volume of RDP credentials sold on underground markets.
As observed on Shodan, the number of exposed systems is higher for China (37% of total) and the United States (37% of total), so it is interesting to note that the number of stolen RDP credentials from the US (4% of the total) for sale is comparatively much lower than other nations. We believe this may be because the actors behind the market sometimes hold back RDP credentials without publishing their whole list.
How are Attackers Breaching Remote Systems?
Weak passwords remain one of the common points of entry. Attackers can easily use brute force attacks to gain access. In the below image we see the 20 most used passwords in RDP. We built this list based on information on weak passwords shared by a friendly Law Enforcement Agency from taken down RDP shops.
The diagram below demonstrates the number of compromised systems using the top 10 passwords. What is most shocking is the large number of vulnerable RDP systems that did not even have a password.
The RDP protocol also suffers from vulnerabilities and needs patching. Last year, we explained in detail the workings of the BlueKeep vulnerability that affects reserved channel 31, which is part of the protocol functionality, to allow remote code execution.
In early January, additional flaws related to Remote Desktop Gateway were also patched:
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0609
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0610
These two vulnerabilities are similar to the BlueKeep vulnerability and allow remote code execution by sending a specially crafted request. We have not yet observed this vulnerability exploited in the wild.
To secure the RDP protocol, the following checklist can be a good starting point:
- Do not allow RDP connections over the open Internet
- Use complex passwords as well as multi-factor authentication
- Lock out users and block or timeout IPs that have too many failed logon attempts
- Use an RDP gateway
- Limit Domain Admin account access
- Minimize the number of local admins
- Use a firewall to restrict access
- Enable restricted Admin mode
- Enable Network Level Authentication (NLA)
- Ensure that local administrator accounts are unique and restrict the users who can logon using RDP
- Consider placement within the network
- Consider using an account-naming convention that does not reveal organizational information
For more details about how to secure RDP access, you can refer to our previous blog (https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rdp-security-explained/)
Conclusion
As we discussed, RDP remains one of the most used vectors to breach into organizations. For attackers, this is a simple solution to quickly perform malicious activities such as malware, spam spreading or other types of crime.
There is currently a whole business around RDP on the underground market and the current situation has amplified this behavior. To stay protected, it is essential to follow best security practices, starting with the basics, such as using strong passwords and patching vulnerabilities.
McAfee ATR is actively monitoring threats and will continue to update you on this blog and its social networking channels.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
