Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Security Crime Microsoft Networking IT

'Lazy' Hackers Exploit Microsoft RDP To Install Ransomware (sophos.com) 72

An anonymous reader writes: An investigation by Sophos has uncovered a new, lazy but effective ransomware attack where hackers brute force passwords on computers with [Microsoft's] Remote Desktop Protocol enabled, use off-the-shelf privilege escalation exploits to make themselves admins, turn off security software and then manually run fusty old versions of ransomware.
They even delete the recovery files created by Windows Live backup -- and make sure they can also scramble the database. "Because they've used their sysadmin powers to rig the system to be as insecure as they can, they can often use older versions of ransomware, perhaps even variants that other crooks have given up on and that are now floating around the internet 'for free'."

Most of the attacks hit small-to-medium companies with 30 or fewer employees, since "with small scale comes a dependence on external IT suppliers or 'jack-of-all-trades' IT generalists trying to manage cybersecurity along with many other responsibilities. In one case a victim was attacked repeatedly, because of a weak password used by a third-party application that demanded 24-hour administrator access for its support staff."
This discussion has been archived. No new comments can be posted.

'Lazy' Hackers Exploit Microsoft RDP To Install Ransomware

Comments Filter:
  • [quote]In one case a victim was attacked repeatedly, because of a weak password used by a third-party application that demanded 24-hour administrator access for its support staff[/quote] Why does some companies put up with shit like this and repeatedly?
    • by Anonymous Coward

      Two obvious possibilities.

      1. The company's staff are idiots.
      2. Someone's getting a kickback.

      I've seen both, often.

    • by Bert64 ( 520050 )

      There needs to be accountability for third party vendors who insist on insecure configurations like this...
      The trouble is most of their customers don't have the knowledge in house to realise how insecure it is. I've encountered a few vendors who made ridiculous demands like this and their response has always been "but our other customers dont have a problem".

      They want 24/7 RDP or VNC access direct from the internet, won't use a vpn (which to be fair, having 100 clients each using a different vpn technology

      • But still, letting 3d party full access to your servers/infrastructure must sound off some alarms at even "stupid company"?

        I often face the opposite problem, which is that if the customer would just open a temporary ssh or rdp session then I could quickly fix a problem that they themselves struggle for weeks on end to solve. That or IT departments that refuse to open ports in their FW because they made their decision back in 1975 on which protocols to allow. But then banks/finance is a conservative industry

    • This isn't arstechnica.com where you indeed [quote]like this.[/quote]
  • You're either a hacker or you're not.

    What the article talks about isn't hacking. It's using what actual hackers have made/found to maliciously exploit software for their own purposes/enjoyment.
    I don't practice hacking, but I have a pretty deep respect for the actual hackers. Most of the time the when the mainstream media uses the term, they're referring to script kiddies.

    It shouldn't have to be repeated on a site like this that hacking isn't necessarily malicious by definition.

    since "with small scale comes a dependence on external IT suppliers or 'jack-of-all-trades' IT generalists trying to manage cybersecurity along with many other responsibilities.

    Not just the small scale busin

    • Most of the time the when the mainstream media uses the term, they're referring to script kiddies.

      Alas, we do not get to decide what terms stick and which ones do not. Like it or not, "Hackers" is a negative label, they are seen as criminals, end of story. "Script kiddies" never caught on the mainstream, if you use that, 99% of people won't know what you're talking about.

      I believe the current euphemism for "good guy hackers" is "Security Analyst" or whatever other euphemism you wanna pick. They're not hackers anymore, those are the bad guys.

      • by Altrag ( 195300 )

        I'm pretty sure there is no real euphemism for "good guy hackers," at least in the mainstream. The hacking community itself of course has whatever labels ("white hat" vs "black hat" or you still occasionally see "hacker" vs "cracker" or whatever.) But the mainstream doesn't really care about a guy who's legitimately hired to do penetration testing and doesn't exploit the weaknesses he finds, so they don't really need a common term for the role.

  • ... and the firewall logs showed everybody and their uncle, from all over the world, trying to get in.

    What I did was go to the registry and change the standard port from 3389 to the last 4 digits of our front office telephone and block 3389 inbound/outbound at the firewall.

    Those with remote desktop privileges had to append the new port to the RDP request:

    173.234.22.16:9182

    That stopped that shit.

    • by fph il quozientatore ( 971015 ) on Sunday November 19, 2017 @11:52AM (#55581433)

      Thanks, I have noted down that number now.

      --your friendly network neighbourhood hacker.

    • Switching the SSH port is helpful as well, if you expose port 22 at all to the outside world. So is blocking and forcing users to use specified, non-standard VNC ports: too many personnel at home use that to work their way around workplace password management. I've personally encountered too many IT personnel who slip past their own workplace access policies by slipping a VNC installation onto their most critical servers, so they can access it as needed or share on-site screens with offsite access.

      When in a

      • by Bert64 ( 520050 )

        Switching SSH to require keys and to reject password auth helps a lot...Although some very stupid brute force scripts will keep trying and cause unnecessary load... Some scripts are even aggressive enough to dos the ssh service.

        • That can be a useful step. There are tradeoffs. I've had difficulty discouraging SSH users from storing passphrase keys locally, and on remote gateway hosts they wish to SSH _from_ in the field without bothering with ssh-agent.

          • by Bert64 ( 520050 )

            I don't use ssh-agent, rather i use the ssh config to specify using another instance of "ssh -w" as a proxy in order to connect to specific hosts, that way the intermediary host is basically just used as a proxy and your local device still authenticates to the far host even if there are one or more intermediary hosts in the way.

    • What I did was go to the registry and change the standard port from 3389 to the last 4 digits of our front office telephone and block 3389 inbound/outbound at the firewall.

      This is a good idea. I personally never leave any sort of potentially hazardous service on a 'known' port. Never the default. Yeah, it's security via obscurity, but a little of that never hurts anything. Just be aware, a determined attacker can scan your ports and find where you moved it to. But it does defeat most of your run-of-the-mill cookie cutter hacking.

      Moving services to non-default ports is a great way to fly under the radar of most simple attack vectors. But still, firewalls, isolation of ou

      • Your points are well taken.

        The RDP attacks, however, were simple (back then) and scripted.

        It's sorta like having burglar bars.

        Crooks will pass those up and look for easier targets.

    • Those with remote desktop privileges had to append the new port to the RDP request:

      173.234.22.16:9182

      That stopped that shit.

      Very clever, if that IP address points to your competitor or NSA.

      Very dumb if it is really pointing to your own server.

      • Why would it be clever if it pointed somewhere else?

        That does not get me in.

        And, foreign (and even domestic) intruders don't bother looking for misdirected ports.

        There are enough easy targets on 3389.

        • foreign (and even domestic) intruders don't bother looking for misdirected ports.

          This is horribly incorrect and I hope you're not responsible for putting production servers behind a 'misdirected port' as there are plenty of port scanners that will identify RDP, SSH, etc., on non-standard ports and will attempt to bruteforce them with common name dictionary attacks for the username and whatever it is they're doing with passwords.

          I have an RDP honeypot setup on one of my home IPs so I can observe the behaviours of trojans, hackers, etc., and with my RDP hosted on a port higher than 10,

  • Is that RDP thing on by default on Windows 10?

    • Re:So... (Score:4, Interesting)

      by Antique Geekmeister ( 740220 ) on Sunday November 19, 2017 @12:03PM (#55581471)

      No, it's not. But it's _very_ common to activate it foe personnel who use their more powerful desktop systems for telecommunication. It's also very standard to enable for Windows hosts in a machine room, unless you've the time and resources to set up a remote KVM or the hardware based remote consoles such as DRAC. Those hosts are often surprisingly vulnerable. The various security improvements of a server environment can be overwhelmed by the unwillingness to update, and reboot, production servers. It's also often overwhelmed by the need to support older software. I _still_ see critical XP systems in unprotected internal networks, used for legacy software or proprietary software for which an upgrade is very expensive.

  • 3 ways to crack (Score:5, Interesting)

    by gurps_npc ( 621217 ) on Sunday November 19, 2017 @12:02PM (#55581467) Homepage

    Correct me if I am wrong, but there are three basic ways to crack a password.

    1) Brute force - the answer to this is long passwords and to have each password attempt take twice as long as the last. I.E. The second attempt after a failure waits 5 seconds. The third attempt takes 10 seconds, the fourth takes 20 seconds, etc. For password length you can use an md5 hash of a selected read -only file. If the system is set up right it will take less mouse clicks to do than the 8 keyboard clicks currently used

    2) Social Engineering - the answer to this is a two factor token system, preferably a key fob rather than just using the phone which is easily lost, stolen, or compromised. Can easily be combined with the increasing time method above.

    3) Password lists (either stolen or public). Outright forbid the 10,000 most common passwords and tell people that if they reuse the same password, they can be fired from their job and can not sue. Don't blame the company when the user is stupid.

    Note that it is NOT a requirement to change the passwords often, as long as you obey the three requirements above, changing the password can be done once a year without affecting safety.

    • Correct me if I am wrong, but there are three basic ways to crack a password.

      You missed the most often used method: Find a broken service to exploit for code execution on the target. No passwords needed, system hacked.

    • by vux984 ( 928602 )

      "2) Social Engineering - the answer to this is a two factor token system, preferably a key fob rather than just using the phone which is easily lost, stolen, or compromised. Can easily be combined with the increasing time method above."

      According to my password safe I have over 100 passwords. Are you really advocating I cart around a wheelbarrow full of key fobs as the solution?

      Never going to happen. NEVER.

      And the worst part is that a fob doesn't even stop social engineering attacks.

      "Hi Alice I'm Bob from IT

      • by Bert64 ( 520050 )

        Over a network biometrics have to be converted to digital data, basically a key or a hash which can be attacked in the normal ways.

        Also once compromised, biometrics remain compromised forever...

        • by vux984 ( 928602 )

          Over a network biometrics have to be converted to digital data, basically a key or a hash which can be attacked in the normal ways.

          Yes. That's why I wrote there were implementation and other problems.

          Also once compromised, biometrics remain compromised forever...

          That's only a problem if you use it as a 'secret password'. Its more like your username. And its value is not that it is a secret but that it is (ideally) difficult to forge.

    • by houghi ( 78078 )

      Number 3. Where I live you sure can tell people they can't sue, but that does not mean they can't sue. They could even sue you for telling them they can't sue.
      Some places have rights that can not be taken away by a contract.
      IT needs to realize that people are part of the security issue. Blaming them does not make anything safer.

      I have so many logins and passwords that it would be unreasonable to have them all different. So I have 6
      1. Most secure for my email as confirmations are send there
      2. Most secure for

  • V......P.....N (Score:4, Interesting)

    by Halster ( 34667 ) <haldouglas@gm a i l .com> on Sunday November 19, 2017 @03:32PM (#55582413) Homepage

    Oh for crying out loud people. Don't open RDP ports direct to the internet!

    If the average Joe can use a VPN to pirate movies I should think YOU could use it to secure your damn network!

    L8r.

    • How else are they going to do get help to close those problems that the nice "Hello I'm calling from Windows" people with Indian accents detected?
    • by nnull ( 1148259 )
      I was wondering when someone was going to mention a VPN. What is so difficult in setting one up? People opening up their firewalls out in the open is asking for trouble. Granted, you get people trying to brute force your VPN just the same, but at least I can contain it (Auto Ban) and I know what it is.
    • by Altrag ( 195300 )

      Setting up a VPN host is a lot more challenging than setting up a VPN client, unfortunately. I mean it probably doesn't have to be, but currently it is.

      Part of the problem is Microsoft. There's a lot of VPN routers out there that have fairly easy VPN setups.. for IPSec-style VPNs only. And Windows doesn't easily support those out of the box. So you can setup PPTP (or L2TP or similar) client in Windows pretty easily, and you can setup IPSec in routers pretty easily. Neither really play well with the oth

  • I see a bunch of comments suggesting that it's dumb to expose RDP to the internet, and if you had just used a VPN... But this isn't an RDP (which is encrypted) exploit... this is brute forcing the password. If you can brute force the RDP account, then why couldn't you brute force the VPN credentials?
    • by nnull ( 1148259 )
      Nothing really stopping you from brute forcing a VPN and it does happen. However, you have less exploitable methods of getting into the system than opening random ports on your firewall for SSH or RDP. Then of course, anyone that allows their VPN to be brute forced is pretty stupid.
    • Brute force a certificate? This is a job for IPBan.
    • by Bert64 ( 520050 )

      You'd setup up a VPN to use certs instead of passwords, which are much more difficult to brute force...
      Even if you successfully got access to the VPN, you'd then only have access to the RDP port which means you now have a second target to attack, so it adds an extra line of defence. And hopefully a competent sysadmin would notice VPN logins from unexpected locations.

  • The only way an RDP session is being successfully initiated from outside your WLAN is if there's port forwarding setup on your router or you have a static IP direct to your computer. In nearly every other case, you're behind a NAT, which would allow you to initiate a RDP connection but not receive. On the router or firewall, remove any forwards and/or disable any sort of DMZ, and you're OK.

    "Sophos security experts" aren't cited as saying anything about this, because of course, the recommended method of medi

  • RDP Guard - It's expensive for what it does, but it does work. Essentially, it's just an anti-hammering app that tar-pits or blocks a public IP as a source from too many invalid logins. Those IPs are blocked at the Windows Firewall. Honestly, this functionality should have, and in fact, could be implemented in the Windows Server OS if MS so choose. It's trivial.

    https://rdpguard.com/ [rdpguard.com]

"Money is the root of all money." -- the moving finger

Working...