Slashdot Mirror
Windows Remote Desktop Exploit In the Wild
angry tapir writes "Luigi Auriemma, the researcher who discovered a recently patched critical vulnerability in Microsoft's Remote Desktop Protocol (RDP), published a proof-of-concept exploit for it after a separate working exploit, which he said possibly originated from Microsoft, was leaked online on Friday. Identified as CVE-2012-0002 and patched by Microsoft on Tuesday, the critical vulnerability can be exploited remotely to execute arbitrary code on systems that accept RDP connections."
Doesn't everyone with a clue use it via a VPN anyway?
It cannot "be exploited remotely to execute arbitrary code". It can only crash the service. There is no RCE developed for this vulnerability, yet. The article itself even says this (even though it's author submitted it here):
"""
Creating a working exploit for the CVE-2012-0002 vulnerability is not trivial, Microsoft security engineers Suha Can and Jonathan Ness said in a blog post on Tuesday. "We would be surprised to see one developed in the next few days. However, we expect to see working exploit code developed within the next 30 days."
The PoC is pretty basic, but an experienced exploit writer can modify it to achieve remote code execution, the researcher said.
"""
Yes, MS12-020 is a big deal. But, not THAT big of a deal, yet. Stop flinging FUD around about things that haven't yet happened.
As the receptionist told me "RDP? Well at least it does not affect windows."
This is the third story about this vulnerability.
"OMG - some software has a vulnerability!"
"OMG - someone's written a proof of concept attack!"
"OMG - someone else has done the same!"
This is even more ridiculous than stories about Bitcoin or the Raspberry Pi. Well, maybe not Bitcoin; that's just fucking retarded.
Remote Desktop Service is running on my system, but I restrict the users by some source IP addresses enabling Windows Firewall.
Exploit packets would reach the target host.
Is it dangerous in my case?
Turns out I already had it disabled (it's disabled by default?), but here's how to disable it in Windows XP or via group policy. Here's how to do it in Windows 7 (untested).
It's disabled by default on all consumer versions of their OS. It's been a while since I've installed 2003 or 2008, so I don't know if it's disabled on those systems.
Which makes me doubly pissed that I'd set up a game download overnight last night (my usage is unmetered overnight) and they decided to force an unneeded patch/reboot on me, which fucked up the download. :/
Which makes me doubly pissed that I'd set up a game download overnight last night (my usage is unmetered overnight) and they decided to force an unneeded patch/reboot on me, which fucked up the download. :/
I concur that default does indeed suck, you can do a registry change to disable it though:
http://support.microsoft.com/kb/555444
And yes I use Linux too and realise such pointless hacks aren't necessary :P
The patch was already out before this information was "leaked".
Thank you... I'll look into it.
My Windows machine gets turned on once a week, maybe... I use it on my days off to play computer games if the spirit moves me. Today, I think I'd rather go for a bike ride. :)
... and not to trust the security of people that can't even keep their stuff running when it's a leap year too much. They've even had stuff that executes arbitrary code inside images - some of their software just trusts the environment too much so that you have to control the environment their software runs in very carefully.
gpedit can be used to control that setting as well. Might be easier to remember for the purposes of multiple systems.
This thread is going to be hijacked by paid astroturfing M$ fanbois (yup, it's not incompatible) explaining that SSH had a security hole "recently" and that hence Linux is as insecure as Windows...
What did /. become :(
It's amazing one mans hobby in realitive terms makes the entire industry look like a collection of clueless script kittens.
The man is a giant... who must be high on powerup mushrooms by now.
I use it on my days off to play computer games if the spirit moves me. Today, I think I'd rather go for a bike ride. :)
Win 7 Home Premium doesnt have gpedit, just sayin.
Good-bye
VPN often leads to a false sense of security. People see it as a panacea, if you just run VPN everything is good. You can see that on Slashdot with the "How could someone not have it behind VPN?" comments as though VPN is the One True Way(tm) to security and they can't conceive any other way.
So someone sets up a VPN and has a trusted/untrusted idea with the firewall and then doesn't properly mind after the "trusted" area since after all, there's the magic VPN protecting it. An employee then bring in an infected laptop, or VPNs in from an infect computer, punching through all the defenses and it is game over.
They are much less safe than someone who does allow RDP in and thus views all networks, including internal, as untrusted and is up on patching this.
Really VPNs are not a security tool for keeping attacks and so on out. What they are is for logically (virtually) connecting two disparate networks. You have office A and office B and you want them to be one logical network, a VPN will get you that. They are also good for encrypting communications if other security can't be relied upon. For example when I'm in an airport I use VPN since their WiFi is open to the world.
This idea that they are some sort of wonderful network security is rather flawed, they can be just the opposite. If an outside computer, not controlled by you, is allowed to punch through the firewall using VPN and become "trusted" to a degree, they are less secure. Also sometimes they are bad on the user end too as a number of them punch through user protections. Some VPN/software firewall combinations can't successfully identify the VPN as a network adapter and thus it punches right through all client side filtering. Combine that with a public IP on the end of the VPN concentrator and you can take someone who was protected with a NAT and host based firewall and expose them to the world, just by them logging in.
Don't get me wrong, I'm not anti-VPN, but people need to think critically about what they are really good for, how they need to be implemented, and stop with this "Everything should be behind VPN, it makes it more secure!" No, it can make it less secure if you fuck up.
For a hacker the good news would be they have control of a Windows machine. The bad news would be...they have control of a Windows machine.
Coder's Stone: The programming language quick ref for iPad