The cloud is here to stay. But for many organizations, the challenge of managing their cloud assets and associated cloud risk still feels like a moving target.
The Internet has created myriad ways for people and organizations to connect with one another. Unfortunately, attackers will attempt to find and exploit the Internet presence of an organization. All of the connections, profiles, pages, and posts can be discovered and potentially weaponized in both targeted and opportunistic attacks.
On May 14th, 2019, Microsoft released a patch for a pre-authentication vulnerability affecting several versions of Windows. Microsoft even released a patch for end-of-life software because the vulnerability is so serious that it has the potential to create a WannaCry-styled global outbreak. In this post, we’ll talk about RDP, the vulnerability, and how you can make sure that you’re secure.
RDP: Already Known to be Trouble
Remote Desktop Protocol is a Microsoft-based service that allows a user to remotely connect to a device and interact with it through a virtual interface. It’s like a screen share where you can control what’s happening on the projected screen. RDP is a very useful tool but was never intended to be exposed to the public Internet. If it is ever compromised, the attacker can do just about whatever they want; it’s as if they were sitting in front of the physical device.
RDP has a lot of known issues. In fact, RDP is one of the most common entry vectors for ransomware. The SamSam campaign has targeted dozens of organizations, bringing down hospitals and local government. Attackers scan the global Internet looking for exposed devices open on RDP and then attempt a brute-force password guessing attack. If strong passwords and lockouts aren’t used, the attacker can gain direct access to a user’s machine and then begin to move laterally. It’s incredibly dangerous to have one thin layer separate attackers from a user’s device, which is exactly how RDP operates when it is publicly exposed.
RDP is already known to be risky. But CVE-2019-0708 — also known as BlueKeep — takes things up a notch by allowing an attacker to remotely execute code pre-authentication with no user interaction. This is just about as bad as it can get for a vulnerability. All an attacker needs is a vulnerable device; no user to click on anything, no privileges, nothing. And the complexity of the attack is low, meaning that attackers will reverse engineer the exploit quickly.
The result could be a program that seeks out vulnerable devices (of which there are many), automatically infects them, and then continues to spread. These worms, which are self-propagating infections, are the worst kind and can quickly spiral out of control.
In 2017, WannaCry infected around 200,000 machines across 150 countries via a similar mechanism (SMB). Hospitals were hit especially hard, rendering their computer systems unusable. An RDP worm could cause similar damage, making this a vulnerability that’s especially important to patch immediately.
Cover Your Assets
With all of the dangers associated with RDP, you might think that it is tightly controlled and rarely exposed. But you’d be wrong. In the past two weeks, Expanse observed RDP instances exposed at 50% of the Fortune 500. Seventy percent of the Fortune 100 had at least one exposure in the past three months.
Why are these exposures so common? Mostly because they occur in an organization’s blind spot, namely cloud and ISP IP space. Some employees purposely expose their laptops on RDP to get work done. Other times, misconfigurations can result in an employee’s laptop being exposed while they travel.
These exposures occur outside of an organization’s known IP space. It could be in IP space registered to a coffee shop, a hotel chain, or their home Internet connection, but it can be nearly impossible for the security team to detect the exposure unless they are monitoring the global Internet.
Expanse identifies rogue RDP exposures via signature-based detection. Cyber risk analysts use Expanse’s internal mapping engine to discover and track specific configuration details. These are used to track RDP exposures no matter where they occur. Exposures that reside in on-prem, cloud environments, consumer dynamic IP space, or any other portion of the Internet can be found when you monitor everything.
To help organizations protect themselves, we’re offering a complimentary report on your RDP exposures.
How do you know who your assets are talking to? If you don’t have visibility into risky communications your assets and employees are engaging in, you can’t secure your network and your data. Subsidiaries and strategic suppliers only make this more complicated, because while you don’t generally have direct visibility into their networks, risky behavior can still negatively affect your security posture.
Before joining Expanse as a Cyber Risk Analyst, I worked as a cybersecurity consultant for one of the Big Four auditing and professional services firms. In that time, I got a front-row seat to the security challenges facing enterprises today. I learned to be skeptical of the cyber maturity of the “big guys,” or the large and well-established enterprises that are connected to the daily lives of millions. While working with clients of all sizes across multiple industries, I realized very few organizations have even a decent grip on their actual cybersecurity posture.
A comprehensive understanding of what assets are yours is the foundation of a secure organization. If you have gaps in visibility or assets you don’t know about, then you are at risk. These gaps and unknowns are the footholds that attackers will use to get into your organization.
Because networks change frequently (even daily), the asset list you had yesterday is not likely to be accurate unless it’s being continuously updated automatically. That means that if you’re using a manual process, such as self-reporting and an Excel spreadsheet, you’re already behind.
An automatically populated asset list allows your security teams to pull from a list that is continuously updated, including when infrastructure or configurations change, mergers occur, or new assets are put into production. You can automatically learn when a server or service is exposed, like the accidental exposure of a database to the Internet, a poorly configured remote endpoint running RDP, when the Marketing or Human Resources team launches a new service in an unapproved cloud vendor in Asia, or when your developers stand-up an insecure test or dev system in AWS. These are all potential unknown unknowns and points of entry into your organization.
It’s Time for a Global View of Your Internet Assets
Your existing suite of security tools only secures what they know about. Vulnerability Management tools, for example only scan what is known. Cloud Security Management Platforms, meanwhile, only manage accounts you already know about — you tell them what to watch, and then they’ll watch them.
With Expanse Expander, however, you discover all of your Internet-exposed assets, including those you don’t know about. Those unknowns are often a large part of your exposed attack surface — we routinely discover 30% more assets than a given organization was tracking previously.
We do this by continuously indexing the entire global Internet and collecting data about all the assets we discover. We use customer signatures like certificates, domains, registration information, and more to automatically tie the assets we see back to their parent organization, providing our customers with a complete, outside-in view of their networks and everything that belongs to them. With our new Cloud Module, we can even associate assets in the constantly changing ephemeral IP space back to organizations. We do this across all cloud providers.
Security begins with knowing what you need to protect. Learn more about how to automatically discover and monitor your Internet-connected assets in our latest tech brief:
Every new role brings new challenges and surprises with it. My first month at Expanse has been a firehose of information and training sessions, all of which I expected to have during the first month at a new job. But during my one-month check-in with my manager, one thing that I didn’t expect was to be asked: “What’s surprised you the most?”