RDP and CVE-2019-0708: What You Need To Know

RDP and BlueKeep: What You Need To Know

On May 14th, 2019, Microsoft released a patch for a pre-authentication vulnerability affecting several versions of Windows. Microsoft even released a patch for end-of-life software because the vulnerability is so serious that it has the potential to create a WannaCry-styled global outbreak. In this post, we’ll talk about RDP, the vulnerability, and how you can make sure that you’re secure.

RDP: Already Known to be Trouble

Remote Desktop Protocol is a Microsoft-based service that allows a user to remotely connect to a device and interact with it through a virtual interface. It’s like a screen share where you can control what’s happening on the projected screen. RDP is a very useful tool but was never intended to be exposed to the public Internet. If it is ever compromised, the attacker can do just about whatever they want; it’s as if they were sitting in front of the physical device.

RDP has a lot of known issues. In fact, RDP is one of the most common entry vectors for ransomware. The SamSam campaign has targeted dozens of organizations, bringing down hospitals and local government. Attackers scan the global Internet looking for exposed devices open on RDP and then attempt a brute-force password guessing attack. If strong passwords and lockouts aren’t used, the attacker can gain direct access to a user’s machine and then begin to move laterally. It’s incredibly dangerous to have one thin layer separate attackers from a user’s device, which is exactly how RDP operates when it is publicly exposed.

WannaCry 2.0

RDP is already known to be risky. But CVE-2019-0708 — also known as BlueKeep — takes things up a notch by allowing an attacker to remotely execute code pre-authentication with no user interaction. This is just about as bad as it can get for a vulnerability. All an attacker needs is a vulnerable device; no user to click on anything, no privileges, nothing. And the complexity of the attack is low, meaning that attackers will reverse engineer the exploit quickly.

The result could be a program that seeks out vulnerable devices (of which there are many), automatically infects them, and then continues to spread. These worms, which are self-propagating infections, are the worst kind and can quickly spiral out of control.

In 2017, WannaCry infected around 200,000 machines across 150 countries via a similar mechanism (SMB). Hospitals were hit especially hard, rendering their computer systems unusable. An RDP worm could cause similar damage, making this a vulnerability that’s especially important to patch immediately.

Cover Your Assets

With all of the dangers associated with RDP, you might think that it is tightly controlled and rarely exposed. But you’d be wrong. In the past two weeks, Expanse observed RDP instances exposed at 50% of the Fortune 500. Seventy percent of the Fortune 100 had at least one exposure in the past three months.

Why are these exposures so common? Mostly because they occur in an organization’s blind spot, namely cloud and ISP IP space. Some employees purposely expose their laptops on RDP to get work done. Other times, misconfigurations can result in an employee’s laptop being exposed while they travel.

These exposures occur outside of an organization’s known IP space. It could be in IP space registered to a coffee shop, a hotel chain, or their home Internet connection, but it can be nearly impossible for the security team to detect the exposure unless they are monitoring the global Internet.

Expanse identifies rogue RDP exposures via signature-based detection. Cyber risk analysts use Expanse’s internal mapping engine to discover and track specific configuration details. These are used to track RDP exposures no matter where they occur. Exposures that reside in on-prem, cloud environments, consumer dynamic IP space, or any other portion of the Internet can be found when you monitor everything.

To help organizations protect themselves, we’re offering a complimentary report on your RDP exposures.

Network

3 Security Issues Every Organization Should Worry About

Before joining Expanse as a Cyber Risk Analyst, I worked as a cybersecurity consultant for one of the Big Four auditing and professional services firms. In that time, I got a front-row seat to the security challenges facing enterprises today. I learned to be skeptical of the cyber maturity of the “big guys,” or the large and well-established enterprises that are connected to the daily lives of millions. While working with clients of all sizes across multiple industries, I realized very few organizations have even a decent grip on their actual cybersecurity posture.

Continue reading

Simplify Security with Automated Asset Discovery and Monitoring

Simplify Security with Automated Asset Discovery and Monitoring

A comprehensive understanding of what assets are yours is the foundation of a secure organization. If you have gaps in visibility or assets you don’t know about, then you are at risk. These gaps and unknowns are the footholds that attackers will use to get into your organization.

Because networks change frequently (even daily), the asset list you had yesterday is not likely to be accurate unless it’s being continuously updated automatically. That means that if you’re using a manual process, such as self-reporting and an Excel spreadsheet, you’re already behind.

An automatically populated asset list allows your security teams to pull from a list that is continuously updated, including when infrastructure or configurations change, mergers occur, or new assets are put into production. You can automatically learn when a server or service is exposed, like the accidental exposure of a database to the Internet, a poorly configured remote endpoint running RDP, when the Marketing or Human Resources team launches a new service in an unapproved cloud vendor in Asia, or when your developers stand-up an insecure test or dev system in AWS. These are all potential unknown unknowns and points of entry into your organization.

It’s Time for a Global View of Your Internet Assets

Your existing suite of security tools only secures what they know about. Vulnerability Management tools, for example only scan what is known. Cloud Security Management Platforms, meanwhile, only manage accounts you already know about — you tell them what to watch, and then they’ll watch them.

With Expanse and Edge Expander, however, you discover all of your Internet-exposed assets, including those you don’t know about. Those unknowns are often a large part of your exposed attack surface — we routinely discover 30% more assets than a given organization was tracking previously.

We do this by continuously indexing the entire global Internet and collecting data about all the assets we discover. We use customer signatures like certificates, domains, registration information, and more to automatically tie the assets we see back to their parent organization, providing our customers with a complete, outside-in view of their networks and everything that belongs to them. With our new Cloud Module, we can even associate assets in the constantly changing ephemeral IP space back to organizations. We do this across all cloud providers.

Security begins with knowing what you need to protect. Learn more about how to automatically discover and monitor your Internet-connected assets in our latest tech brief:

Increasing Your IQ Around Attack Surface Reduction

Your Attack Surface Problem Is Really an Asset Management Problem

The foundation of effective security is knowing what you need to protect. Without a full inventory of your Internet-connected assets, you don’t have a clear picture of your attack surface. And that means you can’t identify and remediate exposures. While many organizations today may think they understand their attack surface, the truth is that they don’t because of a fundamental breakdown in asset management and governance.

Continue reading

When attackers need minutes, not hours

When Attackers Need Minutes, Not Hours

Machine-speed attacks mean even brief exposures can be damaging

It has never been more important for organizations to track and monitor their full, global Internet attack surface. Recent research shows that malicious actors can find and attempt to exploit exposures that are up for only minutes. Attackers using sophisticated tools to scan the entire Internet for exposures, coupled with automated, machine-speed attacks can now more easily breach unknown or unmonitored assets, potentially bringing your entire network to a standstill.

Continue reading

Shiny Things

Shiny Things: Why Your Certificates Matter

Who really ever wants to be a target? Unless it is of someone’s affection, it is pretty much never a good thing. Especially in the world of cybersecurity. Now don’t get me wrong, it doesn’t take much to attract the attention of someone hacking for fun, profit, or even to make a statement, but sometimes we do things that attract unnecessary attention to ourselves.

Continue reading

If You Leave it They will Come

If You Leave It, They Will Come

The idea of security through obscurity has been universally rebuffed by laymen and experts alike. Even so, it is still widely relied upon in even the most security-aware organizations. But hiding an asset or vulnerability or weakness from people only works for so long. Eventually, people find it. And those people aren’t always the good guys.

Continue reading

Machine speed attacks create new security risks for remote workforce tech

Machine-speed Attacks Create New Security Risks for Remote Workforce Technologies

RDP and other productivity-enhancing tools leave organizations exposed to attacks on their ever-changing attack surface

In a previous post, we discussed advances in technology that have made it possible to scan the entire public Internet much faster than ever before. Because of these advances, the thought that exposures can simply hide on the Internet is no longer true. You may think that your organization isn’t a target for cybercriminals, but the ease through which an exposure can be found opportunistically means that you may end up a victim anyway.

Continue reading