4 ms·

Almost no big company is using Win10. Its way too early for its adoption. Even then, they'd have a domain policy that requires passwords and the RDP group would

Almost no big company is using Win10. Its way too early for its adoption. Even then, they'd have a domain policy that requires passwords and the RDP group would also be controlled by GPO. Even then, they'd be using VPN or Remote Desktop Gateway to run this, not opening thousands of ports 3389 and one-to-one natting them to desktop machines. I could see small ma&pop companies vulnerable to this, but they're probably vulnerable to a host of things. Most small shops I've worked with have no idea what RDP is anyway, and use third party remote products, if any. Is exploit code out there? If not, then that's quite a leap yet for hackers. In a week or two every win10 machine in the world will have this patched. That's a very short window for what looks like to be an ugly, but tiny edge case. This is further evidence that Win10 is far from fully cooked. We're not touching it until 2018 with preliminary testing starting in 2017. MS rushed this pretty badly after the poor reception to 8. Also further evidence that remote technologies like ssh, rdp, etc should always be wrapped in something else like VPN or at least strictly firewalled off to known good IPs. Surprises happen.

Eridrus 11y ago
> Almost no big company is using Win10. Ok. I'm glad you have a survey of every business out there. > Is exploit code out there? You use any non-Win10 RDP client and enter the username with the blank password. > Also further evidence that remote technologies like ssh, rdp, etc should always be wrapped in something else like VPN or at least strictly firewalled off to known good IPs RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH.
- yuhong 11y ago
  >You use any non-Win10 RDP client and enter the username with the blank password. I think they are referring to automated attacks.
- drzaiusapelord 11y ago
  How long large enterprise takes to move to a new windows has been studied and published. The typical update is close to 4-5 years. Hell, many shops only recently moved from XP to 7. Hell, Win7 is almost seven years old! >You use any non-Win10 RDP client and enter the username with the blank password. What username? What code generates the correct name? That's what I was referring to. Say there is a win10 pro machine with rdp enabled for the account 'jmpendergrast' with no password and listening to 3389 with no firewall blocking it. Wonderful, how many passess until you guess that? Where is the automation code? Note, by default windows will not let you use a password-less account for RDP: https://support.microsoft.com/en-us/kb/303846 https://support.microsoft.com/en-us/kb/303846 So that's another hurdle someone has to get through. Also, when RDP is enabled, it default to the newer versions which don't have this bug. You need to specify legacy access as well. Another hurdle. So let me summarize what needs to happen for this attack to work: Win10 needs RDP enabled with legacy access explicitly allowing non-NLA connections. Then Win10 needs a firewal rule for 3389 from its router or put on the internet without a NAT/Firewall. Then Win10 needs someone to make an account with a password (passwords are mandatory for rdp). Then someone needs to change the registry to allow blank passwords for a RDP user. Then that user needs to remove the password from that account. Then that user needs to be put in the RDP group. And if a home user does this, he or she isn't using a local account they're probably using a MSN account. This is very much an edge case here. >RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH. Everything sucks but FOSS right? How non-biased of you. I won't mention heartbleed and shellshock then.
  - yuhong 11y ago
    >Note, by default windows will not let you use a password-less account for RDP: That is what this bug is about. I think there is a chance that the login screen may show the usernames. Update: reproed and confirmed how it shows the usernames, in fact in some cases it can login automatically!
  - Eridrus 11y ago
    > Everything sucks but FOSS right? How non-biased of you. I won't mention heartbleed and shellshock then. Nope, but OpenSSH (not PAM) is leaps and bounds above everything else. Almost all of your beloved VPN software was probably susceptible to heartbleed. But mostly I've looked at software from "security" companies, and overall it's a steaming pile of shit. It's probably not going to get popped by non-state actors. I'd say the same things about ssh & rdp in general, but rdp has had a non-trivial amount of bugs in it.
    - drzaiusapelord 11y ago
      Corporate VPNs aren't OpenSSL, they're usually IPSec implementations and not susceptible to heartbleed. >It's probably not going to get popped by non-state actors. Not too long ago people were making this argument but including both OpenSSL and OpenSSH. Now its just OpenSSH. Funny how that works. The reality is that layered security is a best practice and just expecting something to be perfect forever because of past performance is a very questionable premise.

Eridrus 11y ago

> Almost no big company is using Win10. Ok. I'm glad you have a survey of every business out there. > Is exploit code out there? You use any non-Win10 RDP client and enter the username with the blank password. > Also further evidence that remote technologies like ssh, rdp, etc should always be wrapped in something else like VPN or at least strictly firewalled off to known good IPs RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH.

yuhong 11y ago
>You use any non-Win10 RDP client and enter the username with the blank password. I think they are referring to automated attacks.
drzaiusapelord 11y ago
How long large enterprise takes to move to a new windows has been studied and published. The typical update is close to 4-5 years. Hell, many shops only recently moved from XP to 7. Hell, Win7 is almost seven years old! >You use any non-Win10 RDP client and enter the username with the blank password. What username? What code generates the correct name? That's what I was referring to. Say there is a win10 pro machine with rdp enabled for the account 'jmpendergrast' with no password and listening to 3389 with no firewall blocking it. Wonderful, how many passess until you guess that? Where is the automation code? Note, by default windows will not let you use a password-less account for RDP: https://support.microsoft.com/en-us/kb/303846 https://support.microsoft.com/en-us/kb/303846 So that's another hurdle someone has to get through. Also, when RDP is enabled, it default to the newer versions which don't have this bug. You need to specify legacy access as well. Another hurdle. So let me summarize what needs to happen for this attack to work: Win10 needs RDP enabled with legacy access explicitly allowing non-NLA connections. Then Win10 needs a firewal rule for 3389 from its router or put on the internet without a NAT/Firewall. Then Win10 needs someone to make an account with a password (passwords are mandatory for rdp). Then someone needs to change the registry to allow blank passwords for a RDP user. Then that user needs to remove the password from that account. Then that user needs to be put in the RDP group. And if a home user does this, he or she isn't using a local account they're probably using a MSN account. This is very much an edge case here. >RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH. Everything sucks but FOSS right? How non-biased of you. I won't mention heartbleed and shellshock then.
- yuhong 11y ago
  >Note, by default windows will not let you use a password-less account for RDP: That is what this bug is about. I think there is a chance that the login screen may show the usernames. Update: reproed and confirmed how it shows the usernames, in fact in some cases it can login automatically!
- Eridrus 11y ago
  > Everything sucks but FOSS right? How non-biased of you. I won't mention heartbleed and shellshock then. Nope, but OpenSSH (not PAM) is leaps and bounds above everything else. Almost all of your beloved VPN software was probably susceptible to heartbleed. But mostly I've looked at software from "security" companies, and overall it's a steaming pile of shit. It's probably not going to get popped by non-state actors. I'd say the same things about ssh & rdp in general, but rdp has had a non-trivial amount of bugs in it.
  - drzaiusapelord 11y ago
    Corporate VPNs aren't OpenSSL, they're usually IPSec implementations and not susceptible to heartbleed. >It's probably not going to get popped by non-state actors. Not too long ago people were making this argument but including both OpenSSL and OpenSSH. Now its just OpenSSH. Funny how that works. The reality is that layered security is a best practice and just expecting something to be perfect forever because of past performance is a very questionable premise.