SANS Institute Identifies 30% Increase in Attacker Interest in Remote Desktop Protocol (RDP) During Month of March
Findings indicate risk to companies that have quickly enabled remote working via RDP during COVID-19 outbreak
BETHESDA, Md., April 7, 2020 /PRNewswire/ -- SANS Institute, the global leader in cyber security training and certifications, has identified a 30% increase in attacker interest in Remote Desktop Protocol (RDP) servers during the month of March 2020. This increase coincides with a significant increase in exposed RDP servers, as measured by Shodan, the search engine that allows users to search the internet for connected devices.
The findings for March are concerning, as they also coincide with the massive surge in companies worldwide that needed to close offices and quickly stand up remote workforces to comply with social distancing restrictions due to the rapid spread of COVID-19. The concern is that, in order to quickly and inexpensively enable employees to work from home, some organizations have implemented RDP, which can expose confidential systems to the public internet.
Dr. Johannes Ullrich, SANS fellow and Dean of Research at the SANS Technology Institute, explains further: "The number of source IP addresses attackers used to scan the internet for RDP increased by about 30% during March, from an average of 2,600 attacking IP addresses to around 3,540 each day in March. RDP is not a protocol that is robust enough to be exposed to the internet. Consequently, we are now seeing attackers actively trading weak credentials which they have identified for these RDP servers. A compromised RDP server can lead to a complete compromise of the exposed system and will likely be used to attack and exploit additional systems inside the network."
Remote Desktop Protocol (RDP) is a protocol developed by Microsoft, which provides users with a graphical interface to connect to another computer over a network connection. It is a cheap and simple way for companies to enable remote working for employees. The user employs RDP client software for this purpose, while the other computer must run RDP server software.
For companies that have implemented RDP, Ullrich advises: "Use unique, long, and random passwords to secure your RDP servers, and if possible, only provide access via a VPN. Microsoft also offers RDP Gateway, which can be used to implement strong authentication policies. You may attempt to limit access to RDP from specific IP addresses if you are not able to implement a VPN right now, but this may be difficult if your administrators are currently working from home with dynamic IP addresses.
"Another option is to use a cloud server as a jump-off point," Ullrich continued. "Whitelist the cloud server and use secure protocols like SSH to connect to the cloud server. This technique may work as a quick fix if you do not want to risk downtime while everybody is working remotely. Many organizations are currently not willing to risk a loss of access to business-critical systems. Modifying remote access and firewall rules may lead to a loss of access that, in some cases, can only be restored by on-site personnel."
Recognising that coronavirus has caused organizations around the world to transition their workforce away from an office to work-from-home environment, and that many organizations lack the policies, resources, or training to enable their people to do so securely, SANS released the "Securely Working from Home" Deployment Kit on March 16. This free kit provides organizations with a step-by-step guide on how to rapidly deploy a training program for their remote staff. All training materials and resources necessary to secure a remote, multi-lingual workforce are included in the kit.
About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 60 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates a practitioner's qualifications via over 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system--the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (https://www.sans.org)
SOURCE SANS Institute
Share this article