NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows
nsa.gov
nsa.gov
I'd say those are the first things that should be done, regardless of the presence of exploits; exposing a port/listening service to the Internet you don't need, especially one that can remotely give complete control to an attacker, is always a bad idea. Fortunately the majority of computers out there are probably behind a NAT, which helps greatly to keep them from being hacked remotely.
Disable remote Desktop Services if they are not required. Disabling unused and unneeded services helps reduce exposure to security vulnerabilities overall and is a best practice even without the BlueKeep threat.
Very good advice --- too bad latest Windows versions have not-so-clearly-described tons of services running by default, many of which phone home in some way, and some of which are nearly impossible to disable...
Source: https://blog.erratasec.com/2019/05/almost-one-million-vulner...
Eventually someone will wormify that vuln in a few weeks or months and it's going to be a big mess when it happens.
Rather than disabling RDP which I think is unrealistic, I think a simple way to increase greatly the security is to set up an IP whitelist. Have a list stored on a secure and reliable location (S3 bucket for instance) and a script running every 5 minutes, looking for changes to that list. If it changed run a simple command to update the remote IP restriction to all the administrative services in the windows firewall.
No solution is bullet proof but this allows you to manage the server remotely with very little inconvenience, without requiring to set up a VPN or an internal network, and goes a long way to reduce the exposure to vulnerabilities and brute force attacks.
I would do the same thing with IPMI.
And I just need 1 packet to puncture.
The scenario I'm referring to, and the one the article describes, is a remote attacker trying to connect to port 3389 of a machine behind a NAT --- without being able to already access the machine in the first place. In other words: you have a public IP X; there's a machine with private IP Y (which you don't know but may be able to guess easily) behind its NAT. No ports are forwarded. You have no access to the machine. How do you establish a connection to port 3389 (or for that matter, any other listening port) on it?
I was just providing my take on when and why would NSA warn for this.
From all the vulnerabilities they know, they chose to publish one that's known and only concerns outdated software. Maybe I'm too skeptical but when the NSA starts leaking fixes for zero day exploits, I'll take them more seriously.
Zero-days are far more useful to them as exploitable points of entry as opposed to patches.
Perhaps it's not wise to have the same organization looking after both the defensive aspects of our security, AND also offensive espionage operations.
But I still don't see how that could be a reason to not take this warning seriously.
I think that the cynical view of this would rather be that they consider the potential harm from someone they don't like, making a 1m machines botnet from this, to be greater that the benefit they get from themselves making a 1m machines botnet.
I think the NSA has a real image problem. They released ghidra. They admitted it was a recruitment tool. They now release this warning which basically tells us to update our software. Anyways, if they really want to improve their image, they need to release zero day exploits and prove it's not just an offensive but also a defensive agency.
The release of an exploitable bug might deny them a couple of targets but will protect millions.
It has the potential to do some serious damage.
I really wonder what the utility for that distribution form is, are there people printing these out? Or is there some requirement for them to generate a document ID that they could not get for plain web/HTML documents?
/s....?
I do!
So here is a third party report for anyone else that views three letter agency URLs as having all the appeal of a trip to a virtual leper colony:
https://www.zdnet.com/article/even-the-nsa-is-urging-windows...
Thanks for taking a bullet for the team on this one, Internet stranger.
Some cops somewhere decided to send a letter to everyone who had a warrant stating they won a boat. To make sure they didn’t immediately run they went through a couple fake formalities like pictures and such until they opened the door to the boat garage. Inside were uniformed officer waiting to make the arrest.
Similarly, if a story is on a website owned by paranoid people with a track record of harm I would prefer to read a third party report. I don't believe I am alone in that.
- your friendly neighborhood intelligence agency.