30% increase in attacker interest in RDP during March

SANS Institute, has identified a 30% increase in attacker interest in Remote Desktop Protocol (RDP) servers during the month of March 2020. This increase coincides with a significant increase in exposed RDP servers, as measured by Shodan, the search engine that allows users to search the internet for connected devices.

The findings for March are concerning, as they also coincide with the massive surge in companies worldwide that needed to close offices and quickly enable employees to work from home to comply with social distancing restrictions due to the rapid spread of COVID-19. The concern is that, in order to quickly and inexpensively enable employees to work from home, some organisations have implemented RDP, which can expose confidential systems to the public internet.

Dr. Johannes Ullrich, SANS fellow and Dean of Research at the SANS Technology Institute, explains further: “The number of source IP addresses attackers used to scan the internet for RDP increased by about 30% during March, from an average of 2,600 attacking IP addresses to around 3,540 each day in March. RDP is not a protocol that is robust enough to be exposed to the internet. Consequently, we are now seeing attackers actively trading weak credentials which they have identified for these RDP servers. A compromised RDP server can lead to a complete compromise of the exposed system and will likely be used to attack and exploit additional systems inside the network.”

Remote Desktop Protocol (RDP) is a protocol developed by Microsoft, which provides users with a graphical interface to connect to another computer over a network connection. It is an inexpensive and simple way for companies to enable remote working for employees. The user employs RDP client software for this purpose, while the other computer must run RDP server software.

For companies that have implemented RDP, Ullrich advises: “Use unique, long, and random passwords to secure your RDP servers, and if possible, only provide access via a VPN. Microsoft also offers RDP Gateway, which can be used to implement strong authentication policies. You may attempt to limit access to RDP from specific IP addresses if you are not able to implement a VPN right now, but this may be difficult if your administrators are currently working from home with dynamic IP addresses.

“Another option is to use a cloud server as a jump-off point,” Ullrich continued. “Whitelist the cloud server and use secure protocols like SSH to connect to the cloud server. This technique may work as a quick fix if you do not want to risk downtime while everybody is working remotely. Many organisations are currently not willing to risk a loss of access to business-critical systems. Modifying remote access and firewall rules may lead to a loss of access that, in some cases, can only be restored by on-site personnel.”

Recognizing that coronavirus has caused organisations around the world to transition their workforce away from an office to work-from-home environment, and that many organisations lack the policies, resources, or training to enable their people to do so securely, SANS released the “Securely Working from Home” Deployment Kit on March 16. This free kit provides organisations with a step-by-step guide on how to rapidly deploy a training program for their remote staff. All training materials and resources necessary to secure a remote, multi-lingual workforce are included in the kit.