Just 2020 things: Miscreants hit remote desktops 700% harder as world's IT teams try to support locked-down staff

Online criminals have increasingly targeted Remote Desktop Protocol connections over the past year, according to infosec biz ESET. During calendar 2020, ESET recorded what it said was a 768 per cent increase in attack attempts on RDP, a key Windows feature for remote working, during the course of the year. Roman Kováč, ESET's …

[deadlockvictim]

That RDP would be a target nowadays is hardly a surprise. I'd be interested to hear from the sysadmins out there to hear what they have to say.

Is it as bad as ESET make out? And are the problems primarily down to end-users not having their home machines not properly updated, to the protocol itself and was this a disaster waiting to happen?

[gr00001000]

Yes. It has been that bad, 2020.

Absolutely this rings true for me, I have personally witnessed it. What is missing from the RDP explainers is that: RDP is AKA terminal services gateway a command line authentication medium. It can be authenticated against in non-GUI command form with repeated password brute force tooling easily. I think that would help folks understand. Threat actors absolutely went after all these new RDP setups, +768% is certainly what I would expect from my CERT position.

Also, some genius MSPs decided to leave Administrator as an option over RDP. Administrator does not have a default lockout as standard. So they get smashed first.

Hackers love recon. They pull usernames from that recon, start using these gleaned usernames on the available RDP services, they get smashed next.

Sites don't restrict GEO or remote access to their RDP. Any IP in the globe can attempt access for full desktop control. Madness. But thats the pandemic.

People have been very slow to learn, Windows O/S and RDP is not a secure or workable soluton for remote working. At all. Firewalls and web servers are things designed to face the internet, not RDP. RD Gateway will still be an easy win with a phishing creds steal.

I have seen over a dozen institution ransomware cases 90% started with pandemic induced RDP. Most had alternating actual malicious tooling/binary delivery methods/TTPs - thats different groups attacking via the same initial vulnerability.

[Anonymous South African Coward]

Never been a victim of RDP attacks, but I prefer to hide all my RDP sessions behind a firewall.

We also upgraded our firewall from a PPTP-VPN based one to a SSL-VPN based one.

Next step will be to look at implementing 2FA for all users, and if possible, alerting sysadmin central to brute-force attacks.

A bit bothersome? Yes.

Safer? Definitely.

[Steve Kerr]

RDP over the internet

Personally, don't see why any IT staff worth their salt would think RDP direct over the internet would be a good thing.

I would assume that a number of these would be management who would say "just get it done but there's no budget for it"

It would be scary to think there are people out there who profess It knowledge that think it would be a good idea.

I can understand if it's very small companies who don't know the repurcussions of allowing something like this.

[Gene Cash]

Re: RDP over the internet

> I would assume that a number of these would be management who would say "just get it done but there's no budget for it"

There's also "get it done right NOW because everyone's working at home due to covid" and not only is there no budget, but there's no time to do it right.

[Anonymous Coward]

Re: RDP over the internet

Plus the IT staff who need to do it are all working from home via RDP.

[Claptrap314]

Re: RDP over the internet

If only. I have direct personal knowledge of a company with wide open RDP into their jumpbox in Azure. Because of the nature of their work, and their position in the market, someone with knowledge of their operations could seriously foul up the US stock markets.

Yes, this was continuously raised to manglement.

[bigfoot780]

Setting up a RD Gateway isn't that much work. Turn on MFA whilst your at it.

[Anonymous South African Coward]

Setting it up is ridiculously easy - but hardening it is where the problem comes in, especially if you don't know what you're doing and have Manglement breathing down your neck due to preceived laziness on your part "what are you sitting there doing nothing for? Go do XYZ, that's more important"...

[Anonymous Coward]

"you're" at it.