5 ms·

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Ser

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

cptskippy 7y ago
I know people do that, what with cloud based VMs and all, but still... I don't get it.
- Someone1234 7y ago
  It should be noted that AWS and other Cloud providers let you set up Security Groups containing specific IP addresses or ranges (i.e. just whitelist your static IP for SSH/RDS access). It isn't as secure as a VPN (and not as convenient), but definitely a stop-gap if you don't want to pay for Client VPN.
- supernintendo 7y ago
  It’s usually to run some old, proprietary software that only has a Windows version.
  - AnIdiotOnTheNet 7y ago
    "Old, proprietary software" describes something like 80% of all the software keeping the modern world going.
    - AstralStorm 7y ago
      Some of it is new software. South Korean love of ActiveX for example, a technology dead for at least 10 years. Still getting new stuff written. On the contrary, most critical software is plenty new - things like MS Office. Still bound to Windows. The remaining systems rely on truly custom software and should be either airgapped (so no RDP) or rewritten. I'm thinking industrial - they should've planned for this many years beforehand. There were instances back when Windows XP was the main driver.
Lendal 7y ago
Almost every Windows computer in the fortune 500 company I work for has RDP enabled and if it wasn't production would grind to a halt. To make matters worse I can't even run Windows updates on my laptop because the IT department has blocked it. I can only run updates at home.
- kgwxd 7y ago
  Are they exposed to the internet or do you have to connect to a VPN first?
  - Lendal 7y ago
    Oh yeah there are all kinds of firewalls, but you know there is always a hole somewhere. (Officially they've contracted with Amazon Workspaces to provide remote access which actually works pretty good, albeit slow.)
Riverheart 7y ago
While internet facing servers may be the most common attack vector you assume the vulnerability couldn't come from inside the network.
- Someone1234 7y ago
  If they're attacking you from an internal vector they likely already have code execution within that internal context, making this bug largely redundant. The more common case is gaining entry to a poorly secured edge or cloud server, rather than a bad actor sitting on your LAN. But sure, I suppose, that niche edge case (local context without local code execution) could hypothetically exist somewhere, but patching this won't make you secure.
  - Riverheart 7y ago
    It's not a niche edge case, there is an entire industry that revolves around securing BYOD devices. If I bring a compromised device on your network and it uses some rdp flaw to access another machine it's gotten a foothold in the network where it could spread further. I don't need code execution from an existing internal resource. And yes, security is a layered approach. That's why we recognize that the internet isn't the only threat vector out there. Edit: Why wouldn't you patch internal servers for this anyway? Let's say there is an existing threat with code execution like you say. Now he can trivially access all machines on the network because they share a common vulnerability. At least make him work for it.
    - Someone1234 7y ago
      > If I bring a compromised device on your network Then I'm in real trouble with or without this. A compromised device can sniff the network, masquerade, inject network traffic (inc. DNS), and can attack every other device on that same segment. > I don't need code execution from an existing internal resource. If you cannot execute code in an internal context then you cannot exploit this bug, you'd effectively be an external attacker. Your own example had you running code on a locally connected "BYOD" device. Therefore you're already executing code in that context. > Why wouldn't you patch internal servers for this anyway? Nobody suggested that. In fact quite to the contrary. By the way while we're discussing niche edge cases, what's your strategy to protect against Van Eck phreaking? Seems about as concrete as the attack vector you're proposing (local network access with no way to execute code).
londons_explore 7y ago
Why has RDP been so vulnerable to exploits for so long? It seems Microsoft should require credentials sent before processing any complex graphics rendering stuff, yet even to this day, it is possible to view a remote logon screen, get remote audio, etc. all unauthenticated!

cptskippy 7y ago

I know people do that, what with cloud based VMs and all, but still... I don't get it.

Someone1234 7y ago
It should be noted that AWS and other Cloud providers let you set up Security Groups containing specific IP addresses or ranges (i.e. just whitelist your static IP for SSH/RDS access). It isn't as secure as a VPN (and not as convenient), but definitely a stop-gap if you don't want to pay for Client VPN.
supernintendo 7y ago
It’s usually to run some old, proprietary software that only has a Windows version.
- AnIdiotOnTheNet 7y ago
  "Old, proprietary software" describes something like 80% of all the software keeping the modern world going.
  - AstralStorm 7y ago
    Some of it is new software. South Korean love of ActiveX for example, a technology dead for at least 10 years. Still getting new stuff written. On the contrary, most critical software is plenty new - things like MS Office. Still bound to Windows. The remaining systems rely on truly custom software and should be either airgapped (so no RDP) or rewritten. I'm thinking industrial - they should've planned for this many years beforehand. There were instances back when Windows XP was the main driver.

Lendal 7y ago

Almost every Windows computer in the fortune 500 company I work for has RDP enabled and if it wasn't production would grind to a halt. To make matters worse I can't even run Windows updates on my laptop because the IT department has blocked it. I can only run updates at home.

kgwxd 7y ago
Are they exposed to the internet or do you have to connect to a VPN first?
- Lendal 7y ago
  Oh yeah there are all kinds of firewalls, but you know there is always a hole somewhere. (Officially they've contracted with Amazon Workspaces to provide remote access which actually works pretty good, albeit slow.)

Riverheart 7y ago

While internet facing servers may be the most common attack vector you assume the vulnerability couldn't come from inside the network.

Someone1234 7y ago
If they're attacking you from an internal vector they likely already have code execution within that internal context, making this bug largely redundant. The more common case is gaining entry to a poorly secured edge or cloud server, rather than a bad actor sitting on your LAN. But sure, I suppose, that niche edge case (local context without local code execution) could hypothetically exist somewhere, but patching this won't make you secure.
- Riverheart 7y ago
  It's not a niche edge case, there is an entire industry that revolves around securing BYOD devices. If I bring a compromised device on your network and it uses some rdp flaw to access another machine it's gotten a foothold in the network where it could spread further. I don't need code execution from an existing internal resource. And yes, security is a layered approach. That's why we recognize that the internet isn't the only threat vector out there. Edit: Why wouldn't you patch internal servers for this anyway? Let's say there is an existing threat with code execution like you say. Now he can trivially access all machines on the network because they share a common vulnerability. At least make him work for it.
  - Someone1234 7y ago
    > If I bring a compromised device on your network Then I'm in real trouble with or without this. A compromised device can sniff the network, masquerade, inject network traffic (inc. DNS), and can attack every other device on that same segment. > I don't need code execution from an existing internal resource. If you cannot execute code in an internal context then you cannot exploit this bug, you'd effectively be an external attacker. Your own example had you running code on a locally connected "BYOD" device. Therefore you're already executing code in that context. > Why wouldn't you patch internal servers for this anyway? Nobody suggested that. In fact quite to the contrary. By the way while we're discussing niche edge cases, what's your strategy to protect against Van Eck phreaking? Seems about as concrete as the attack vector you're proposing (local network access with no way to execute code).

londons_explore 7y ago

Why has RDP been so vulnerable to exploits for so long? It seems Microsoft should require credentials sent before processing any complex graphics rendering stuff, yet even to this day, it is possible to view a remote logon screen, get remote audio, etc. all unauthenticated!