RDP continues to be security nightmare

Stefan Mileschin · 21st September 2019, 18:14

Managing to be both insecure and indispensable

Indispensable enterprise software Remote Desktop Protocol (RDP)enterprise computing is continuing to be a nightmare for admins.

The September 2019 Patch Tuesday round closed two remote code execution bugs in RDP, while the high-profile BlueKeep and DejaBlue vulnerabilities from earlier this year required heavy patchwork

RDP servers are the victims of choice for botnets and more than 1.5 million of them have been brute forced.

Cameyo released on Wednesday an open-source RDP monitoring tool -- appropriately titled RDPmon -- for enterprises to identify and secure against RDP attacks in its environment. The tool provides a visualisation of the number of attempted RDP connections to servers, and view of the currently running applications, the number of RDP users, and what programs those users are running, likewise providing insight to the existence of unapproved software.

RDP was designed with the intent to be run inside private networks, not accessible over the internet.

Despite that, enterprise use of RDP over the internet is sufficiently widespread that RDP servers are a high-profile, attractive target for hackers. The report says Cameyo found that Windows public cloud machines on default settings -- that is, with port 3389 open -- experience more than 150,000 login attempts per week.

https://fudzilla.com/news/49424-rdp-...rity-nightmare

21st September 2019, 18:14	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 148,618	RDP continues to be security nightmare Managing to be both insecure and indispensable Indispensable enterprise software Remote Desktop Protocol (RDP)enterprise computing is continuing to be a nightmare for admins. The September 2019 Patch Tuesday round closed two remote code execution bugs in RDP, while the high-profile BlueKeep and DejaBlue vulnerabilities from earlier this year required heavy patchwork RDP servers are the victims of choice for botnets and more than 1.5 million of them have been brute forced. Cameyo released on Wednesday an open-source RDP monitoring tool -- appropriately titled RDPmon -- for enterprises to identify and secure against RDP attacks in its environment. The tool provides a visualisation of the number of attempted RDP connections to servers, and view of the currently running applications, the number of RDP users, and what programs those users are running, likewise providing insight to the existence of unapproved software. RDP was designed with the intent to be run inside private networks, not accessible over the internet. Despite that, enterprise use of RDP over the internet is sufficiently widespread that RDP servers are a high-profile, attractive target for hackers. The report says Cameyo found that Windows public cloud machines on default settings -- that is, with port 3389 open -- experience more than 150,000 login attempts per week. https://fudzilla.com/news/49424-rdp-...rity-nightmare

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Internal security is nightmare says survey	Stefan Mileschin	WebNews	0	11th March 2019 09:03
Yahoo mail is a security nightmare	Stefan Mileschin	WebNews	0	30th August 2018 07:50
Giving your phone number as ID creates a security nightmare	Stefan Mileschin	WebNews	0	28th August 2018 08:19
Intel’s management engine is security nightmare	Stefan Mileschin	WebNews	0	17th May 2017 05:41
Samsung's in-house OS is a security nightmare	Stefan Mileschin	WebNews	0	5th April 2017 13:12
How used cars became a security nightmare	Stefan Mileschin	WebNews	0	26th February 2017 19:15
Apple’s open OS is a security nightmare	Stefan Mileschin	WebNews	0	25th June 2016 19:11
License plate readers can be a security nightmare	Stefan Mileschin	WebNews	0	30th October 2015 09:07
Toshiba: the nightmare continues	Stefan Mileschin	WebNews	0	1st September 2015 11:26
Chrome is a security nightmare, indexes your bank accounts	jmke	WebNews	0	4th September 2008 14:27