- Jun 7, 2022

How RDP Attacks Go Down

Introduction

Attacks against Remote Desktop Protocol (RDP) aren’t a new technique but have been rising in usage over the last couple of years. This uptick can be attributed to remote work, the technique’s ease and low cost, and high profitability for the threat actor. Used primarily to target smaller businesses with improper configurations, RDP can be your greatest liability. In this blog, we discuss how certain techniques take advantage of RDP insecurities, as well as what mitigation tactics you can implement today.

The Basics: Defining RDP

RDP is a network communications protocol developed by Microsoft in the early 2000s. It is built into enterprise and pro versions of Windows. RDP is used for two primary purposes:

Remote Desktop Access: Users can utilize remote access to their physical work desktop computer from another device.
Remote Administration: Technicians can perform remote administrative work by physically accessing the device.

After the RDP software is connected, the user can use applications, access and edit files, and more, on the connected computer.

RDP Exploited in the Wild

Although attacks against RDP are a current trend, they aren’t new. RDP takeover has been one of the top initial attack vectors used by ransomware threat actors, even before the COVID-19 pandemic. Its place of prominence among other attack vectors, such as email phishing and software vulnerability, is unsurprising for multiple reasons including:

The rise, and continuation, of hybrid and remote work,
The low cost of execution,
The lack of expertise necessary, and
The popularity of utilization among both amateur actors and specialized cybercriminals.

Threat actors have honed in on a vulnerable population with insecure protocol and have gained the necessary means for attack at a low cost, leading to high profitability. Novice threat actors use affiliate-based ransomware services, while experienced cybercriminals specialize in mass distribution of software who buy ransomware.

Getting even more specific, the attack vector used is often indicative of the size of targets a malicious group prefers. Businesses with a lower employee count, often between one to one hundred, usually have lower budgets, insufficient IT security resources, and therefore insecure RDP configurations, leaving their RDP open to the internet. Therefore, many factors are working in favour of malicious actors.

The Realities of Exploited RDP

While RDPs enable remote assistance and work, Pass the Hash (PtH) attacks and Trojan horses, among other tactics, techniques, and procedures (TTPs), can also be deployed using an RDP. Once takeover has occurred, adversaries are able to access and edit anything that the computer has access to. It can also be used as a gateway to hacking into other computers on the affected network.

Security aside, the internet connection necessary to run an RDP should be addressed. If your connection is not strong enough, you may experience latency issues or an inability to connect. If your employees are using this tool, they will need to be close to a router or extender. This diminishes the level of flexibility that it boasts of for remote work to a degree.

How an RDP Attack Goes Down

Hijacking RDP sessions, active or disconnected, can be hijacked without credentials or accepted prompts by the user. They can then be used for login access, malware detonation and/or ‘live off the land’ procedures. PtH can be used to gain lateral movement, giving an attacker the ability to act as any user within the domain. Threat actors can also route RDP connections and move further into an environment through secure proxies. All the while, you may be oblivious, as these tactics appear to be normal network behaviour.

Sticky Keys Adversaries may exploit accessibility features to gain unauthenticated access through a remote desktop login screen. For example, Sticky Keys allows a user to operate their keyboard one-handed, with a typing wand, or a mouth stick. Modifier keys, such as Shift, Alt, and Ctrl, can be pressed one at a time, while your computer reads them as being pressed simultaneously. Within an RDP session, this tool can be used to obtain persistence, maintaining long-term access to systems despite disruptions such as restarts or changed credentials.

Brute Force RDP brute force attacks escalated throughout all of 2020 and 2021 with an increase of 274% in Q4 of 2021. Hackers use tools that auto-attempt passwords repeatedly until they’ve successfully accessed your computer right from the internet. Malicious actors can appear as legitimate users to gain system access and control. Therefore, multiple layers of defence behind login credentials are necessary.

Malware Intrusive software that has been bought, stolen, or downloaded, can be configured to support a cyber adversaries’ operations. One malicious group is known to use two types of malware: one for checking keys within HKEY_CURRENT_USER (HKCU), current user settings, and HKEY_LOCAL_MACHINE (HKLM), machine settings for all users, to determine if a Remote Desktop app is present, and the second for RDP propagation. Computer worms, which replicate themselves, can also be used to spread across other computers. Another type of ransomware enumerates all current Remote Desktop sessions, attempting execution of malware on each one.

Protocol Tunnelling Tunnelling involves explicitly encapsulating a protocol within another. This behaviour conceals malicious traffic by blending in with existing traffic and/or providing an outer layer of encryption. Protocol tunnelling, specifically, misuses RDP. Communications and RDP traffic on a compromised computer can be tunnelled from a victim’s environment over internet connections, through open-source tools, and/or within a separate protocol. The latter enables adversaries to avoid detection or network filtering as well as access to otherwise unreachable systems.

Reducing Your RDP Attack Surface

Beat Them to the Punch:

Restrict user privileges and permissions to those who absolutely need it. Overly permissive roles being assigned to non-privileged accounts can lead to compromised access, privilege elevation, lateral movement.
Operate from a zero-trust mentality.
Establish firewall rules to restrict access to port 3389 and block RDP traffic between network security zones.
Use Remote Desktop gateways.
Make sure Network Level Authentication is enabled in Windows.

Give Hackers a Hard Time:

Implement 2FA or MFA whenever possible.
Utilize strong passwords.
Establish maximum encryption for RDP connections.
Log RDP login attempts.
Limit the number of allowed attempts before the account is locked.
Change Group Policy (GPOs) to establish shorter timeout sessions and set a maximum amount of time a single session can be active, including disconnected sessions.

Keep Your House in Order:

Audit your accounts, groups, and network for systems using RDP.
Remove any unnecessary access to RDP.
Close unused RDP ports.
Block RDP ports from external networks.
Ensure systems are up to date and that auto security updates are taking place.
Consider moving the local administrator group from the list able to log in through RDP.
Disable RDP if possible. If not, put it behind a virtual private network (VPN).

If your networks are compromised, change your credentials immediately.

Summary

The reality is that many organizations rely on core protocols, tools, and practices for their businesses to run efficiently. Many smaller teams require RDP to work smarter, not harder. Keep in mind, though, that what enables us can also enable a malicious actor. If your RDP isn’t properly protected, it can be an easy and inexpensive access point for an opportunistic actor. Understanding the trends, dangers, and mitigation steps allow businesses of all sizes to strengthen their defences when it comes to RDP. Awareness and proper configuration can be what prevent a threat actor from gaining a foothold in your network.

Author: Blackpoint Cyber

https://blackpointcyber.com/resources/blog/how-rdp-attacks-go-down/