Slashdot Mirror
'Lazy' Hackers Exploit Microsoft RDP To Install Ransomware (sophos.com)
An anonymous reader writes:
An investigation by Sophos has uncovered a new, lazy but effective ransomware attack where hackers brute force passwords on computers with [Microsoft's] Remote Desktop Protocol enabled, use off-the-shelf privilege escalation exploits to make themselves admins, turn off security software and then manually run fusty old versions of ransomware.
They even delete the recovery files created by Windows Live backup -- and make sure they can also scramble the database. "Because they've used their sysadmin powers to rig the system to be as insecure as they can, they can often use older versions of ransomware, perhaps even variants that other crooks have given up on and that are now floating around the internet 'for free'."
Most of the attacks hit small-to-medium companies with 30 or fewer employees, since "with small scale comes a dependence on external IT suppliers or 'jack-of-all-trades' IT generalists trying to manage cybersecurity along with many other responsibilities. In one case a victim was attacked repeatedly, because of a weak password used by a third-party application that demanded 24-hour administrator access for its support staff."
They even delete the recovery files created by Windows Live backup -- and make sure they can also scramble the database. "Because they've used their sysadmin powers to rig the system to be as insecure as they can, they can often use older versions of ransomware, perhaps even variants that other crooks have given up on and that are now floating around the internet 'for free'."
Most of the attacks hit small-to-medium companies with 30 or fewer employees, since "with small scale comes a dependence on external IT suppliers or 'jack-of-all-trades' IT generalists trying to manage cybersecurity along with many other responsibilities. In one case a victim was attacked repeatedly, because of a weak password used by a third-party application that demanded 24-hour administrator access for its support staff."
[quote]In one case a victim was attacked repeatedly, because of a weak password used by a third-party application that demanded 24-hour administrator access for its support staff[/quote] Why does some companies put up with shit like this and repeatedly?
You're either a hacker or you're not.
What the article talks about isn't hacking. It's using what actual hackers have made/found to maliciously exploit software for their own purposes/enjoyment.
I don't practice hacking, but I have a pretty deep respect for the actual hackers. Most of the time the when the mainstream media uses the term, they're referring to script kiddies.
It shouldn't have to be repeated on a site like this that hacking isn't necessarily malicious by definition.
since "with small scale comes a dependence on external IT suppliers or 'jack-of-all-trades' IT generalists trying to manage cybersecurity along with many other responsibilities.
Not just the small scale businesses have this issue as we tend to see time and time again in the news...
I tend to rant.
What I did was go to the registry and change the standard port from 3389 to the last 4 digits of our front office telephone and block 3389 inbound/outbound at the firewall.
Those with remote desktop privileges had to append the new port to the RDP request:
173.234.22.16:9182
That stopped that shit.
It little behooves the best of us to comment on the rest of us.
Is that RDP thing on by default on Windows 10?
#DeleteFacebook
Correct me if I am wrong, but there are three basic ways to crack a password.
1) Brute force - the answer to this is long passwords and to have each password attempt take twice as long as the last. I.E. The second attempt after a failure waits 5 seconds. The third attempt takes 10 seconds, the fourth takes 20 seconds, etc. For password length you can use an md5 hash of a selected read -only file. If the system is set up right it will take less mouse clicks to do than the 8 keyboard clicks currently used
2) Social Engineering - the answer to this is a two factor token system, preferably a key fob rather than just using the phone which is easily lost, stolen, or compromised. Can easily be combined with the increasing time method above.
3) Password lists (either stolen or public). Outright forbid the 10,000 most common passwords and tell people that if they reuse the same password, they can be fired from their job and can not sue. Don't blame the company when the user is stupid.
Note that it is NOT a requirement to change the passwords often, as long as you obey the three requirements above, changing the password can be done once a year without affecting safety.
excitingthingstodo.blogspot.com
They shouldn't have been exposed to the internet in the first place. Have anyone who wants to connect to a machine on the lan/wan connect to the network via VPN first
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
You're assuming it's not a honeypot?
My Other Computer Is A Data General Nova III.
Oh for crying out loud people. Don't open RDP ports direct to the internet!
If the average Joe can use a VPN to pirate movies I should think YOU could use it to secure your damn network!
L8r.
"How much truth can advertising buy?" - iNsuRge - AK47
I see a bunch of comments suggesting that it's dumb to expose RDP to the internet, and if you had just used a VPN... But this isn't an RDP (which is encrypted) exploit... this is brute forcing the password. If you can brute force the RDP account, then why couldn't you brute force the VPN credentials?
The point is that small organizations don't usually allow for specialization of duties, and that means less brains working on different aspects of IT.
The additional expense of maintaining staff or services that mitigate the risk of your business getting ass-raped by malware is either worth it to a business owner, or it's not. Small organizations that choose the latter usually become victims. Fuck 'em if they can't learn from best practice.
No one can do it all, it's similar to medicine - no doctor does all parts. It takes about 250 specialists to comprise all aspects of medicine, and that number is increasing daily.
See? There are areas of business that value risk mitigation. 250 specialists exist because when someone in medicine tries to "do it all", it usually ends with a wrongful death lawsuit. Medicine was forced to learn the value of specialists, much like ignorant small business owners are doing today.
The only way an RDP session is being successfully initiated from outside your WLAN is if there's port forwarding setup on your router or you have a static IP direct to your computer. In nearly every other case, you're behind a NAT, which would allow you to initiate a RDP connection but not receive. On the router or firewall, remove any forwards and/or disable any sort of DMZ, and you're OK.
"Sophos security experts" aren't cited as saying anything about this, because of course, the recommended method of mediation is purchase and installation of their Sophos XG Firewall product. If whoever is responsible for your company doesn't already know this and can explain it to you, hire someone who does.
Shows the flaws of account lockouts if they permit someone to launch such a trivial denial of service against your organisation.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
And if you have *ACCOUNT* lockout policies then you get a dos attack instead...
And brute force attacks can still succeed because you just try lots of usernames with a small number of the most common passwords.
Account lockouts are stupid, you want to block the source of the attack (as well as using stronger authentication than passwords on any externally facing system).
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
They shouldn't have been exposed to the internet in the first place. Have anyone who wants to connect to a machine on the lan/wan connect to the network via VPN first
You are assuming there IS a VPN, though and in many smaller organizations that is not the case.
RDP Guard - It's expensive for what it does, but it does work. Essentially, it's just an anti-hammering app that tar-pits or blocks a public IP as a source from too many invalid logins. Those IPs are blocked at the Windows Firewall. Honestly, this functionality should have, and in fact, could be implemented in the Windows Server OS if MS so choose. It's trivial.
https://rdpguard.com/
Life is not for the lazy.