Slashdot Mirror
RDP Proof-of-Concept Exploit Triggers Blue Screen of Death
mask.of.sanity writes "A working proof of concept has been developed for a dangerous vulnerability in Microsoft's Remote Desktop Protocol (RDP). The hole stands out because many organizations use RDP to work from home or access cloud computing services. Only days after a patch was released, a bounty was offered for devising an exploit, and later a working proof of concept emerged. Chinese researchers were the first to reveal it, and security professionals have found it causes a blue screen of death in Microsoft Windows XP and Windows Server 2003 machines. Many organizations won't apply the patch and many suspect researchers are only days away from weaponizing the code."
I heard a rumor that if you send an SYN-ACK after SYN request from a certain IP, you die.
It totally happened to my cousin's friend.
Or something entirely new?
The exploit is one thing, but the real story is that the exploit code was leaked from somewhere inside Microsoft, likely the MSRC. There's a string in the exploit that points to a folder on an internal MSRC server. This is about as bad as it gets. See here: https://twitter.com/#!/jduck1337/status/180495975377408001 and here: https://threatpost.com/en_us/blogs/ms12-020-rdp-exploit-found-researchers-say-code-may-have-leaked-security-vendor-031612
The exploit doesn't allow unauthorized access or remote root. It only allows a denial of service against Windows XP and Windows Server 2003 products. It doesn't seem that Windows 7 and Windows Server 2008 are vulnerable. That really mitigates that risk. I have a Windows Home Server 2011 box that shouldn't be vulnerable because it's based on the WS2008R2 code base. Furthermore, there's already a patch for this bug. Therefore, if you're still running an old version of Windows that you neglected to patch, then your server might be crashed remotely. I don't think it's really that deadly or scary.
A NYC lawyer blogs. http://www.chuangblog.com/
I haven't found the answer to this yet: Virtualbox uses a flavor of RDP (or backwards compatible to RDP) called VRDE. Someone where I worked said this was a protocol problem, so exploit apply to virtualbox or is this just the implementation of RDP that Microsoft uses?
Why are exploits and zero-days in Microsoft products still news? Their product is full to the brim with holes, problems, and exploits. a running tally would be more effective than a news story.
Careful what you say around me.. I will assume you mean it.
I have never seen RDP open to the world. If you do that, you're asking for issues regardless of any exploit.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Can we pleeeeease go back to hating Microsoft now?
Sure, just as soon as you send me a check for all the licensing fees.
http://pastebin.com/nSp1Qxpi
"If any question why we died, Tell them because our fathers lied."
You mean "download for free" then maybe. You realize that all Windows updates for the entire life cycle of the product are included with the purchase price of the original copy, correct? They do not charge a maintenance fee. They are also very up front about life cycle and end of life. 10 years minimum for all OSes. It can be (and often is) extended, but it is never less than that.
Sure, what product do you sell? If I'm interested and it's affordable, I will send you a check in the form of purchasing said product. And if a lot of people like your product they will send you a check for receivable goods or services. Those proceeds will then amount up to this thing called "profit", once you have that you can buy new licenses.
WTF Slashdot, why do I have to login 50 times to post?
Why do i have to pay for you?, You didn't pay for mine, and i own two Windows 7 licences (One Ultimate and one Home Premium).
If you don't want to pay for YOUR licences, then you can complain if you get hacked, if you run XP or 2003 Server, you ran out of support (which you should already know since you buy them), if you don't want to buy new licences, try some free and/or open source OS, i'm sure you'll find out how to set them up, if you don't, i'm pretty sure that they some companies out there are willing to help you, if you pay them.
Remember, nothing is free, not even open source.
There is no particular reason RDP needs to be behind a VPN any more than any other protocol. It is fully encrypted, does secure password exchange and all that jazz. Same as SSH. So if you run any SSH servers that are open to the world, well there's your answer.
If you are all VPN all the time, ok, though I will caution you to carefully check your setup, VPN is often a false sense of security (particularly since in many configurations it punches through the user's NAT and host based firewall and can expose them). However if you are ok with things like SSH to your UNIX systems but not RDP to your Windows systems that just means you have a poor understanding of the protocols.
I use them mainly for IIS, because I happen to work with .Net based web applications... And IIS is a path of less resistance than shoehorning a solution into Mono/Linux. That said IIS is a pretty damned nice web server. There's also AD and Exchange. Those are probably the biggest reasons to run windows based servers.
Michael J. Ryan - tracker1.info
I tried to go to the March 2012 Microsoft Security Bulletin on their website and got a 404 Error. Guess they're updating it with new info? BTW I tested the sample Ruby code that was published and the BSOD worked like a champ on a couple of my older boxes here at work. Good thing I don't use RDP on any Internet-facing hosts. Only through a VPN...
I can't imagine anyone with any important data leaving an X session port open balls-to-the-walls to the Internet, so why on Earth would anyone let RDP, particularly the rather weakly-protected pre-Server 2008 variants, run basically naked like that (not that I would allow a Server 2008 Terminal Server or any other RDP service from a newer OS be visible to the outside world).
We have a Windows Terminal Server plus a few workstations that people can remote into, but they have to come in on our VPN. I closed that channel years ago when I looked on one of our DC security logs and saw a stunning number of dictionary attacks against the Terminal Server.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Actually newer versions of Windows are also included in the patch. Of course learning this would require one to read past the often-incorrect or often-shortsighted summaries :-P
Sorry is "then you CAN'T complain if you get hacked"
So in other words, most XP users won't even realize the exploit...
The cost of running a business and keeping up with the time. You can't purchase and OS and expect free support for eternity.
To be fair, RDP does use encryption, so it isn't wildly wrong to expose RDP to an external site. I wouldn't want to do it myself, but then I use much prefer Linux and use VNC behind SSH tunnels (use -localhost for the VNC server so that it only allows connections from itself).
Hiding RDP behind a VPN should protect from external attacks on this, so security through layers is the answer. I often wonder why FWKNOP http://cipherdyne.org/fwknop/isn't more widely used to hide and protect services.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
...for their entire life.
As a contractor, I see all sorts of companies that do numerous different things for numerous reasons.
To make absolute statements such as "no company would have an outward facing server running 2003 with RDP" or any other such drivel is very small minded.
Very large, publicly traded companies often come from the stone age when they were founded (especially blue-chips offering non-technical services or products), will be running on deprecated systems simply because the 5 previous CIOs or CEOs were inept or just ignorant of the reality of IS / IT.
You can also use Remote Desktop Gateway (RD Gateway). It's a proxy that uses SSL and RADIUS to hit RD Session Hosts behind it. AFAIK, it is not susceptible to this.
Chance favors the prepared mind.
Perfect is the enemy of good.