Microsoft warns: Expect exploits for critical Windows worm hole | Hacker News Reader

Microsoft warns: Expect exploits for critical Windows worm hole

zdnet.com

76 pointsalbont18 comments

A big concern here must be the potential for this bug as a secondary payload for malware delivered over email; virtually no network allows RDP through firewalls without a VPN connection, but RDP is broadly available on most large networks once you're behind the firewall.

Some ISVs "require" direct RDP and won't use VPN. This should be an automatic no-buy, but sometimes the powers-that-be forget to ask the system administrator.

Virtually no network except most universities. The campus Bat Light has just been illuminated.

Universities give external IPs to internal hosts with all ports accessible? That seems unlikely, if only due to IPv4 address space crunches.

This unlikely scenario is in fact true on my campus where I'm an admin. In fact, we are dissuaded from even NAT'ing because it complicates central auditing and internal charge backs.

Every single wired host (including printers) has Class B public IP address.

That's how it was at my school. It was actually very nice, because you could run your own servers from your dorm room or the lab with ease. The only thing they blocked were mail servers, and I think you could get an exemption.

There were basically no limits set on our network, and they even left the Direct Connect hubs alone unless somebody reported them... primarily because when the hubs went down, our outbound link would be completely saturated by bittorrent traffic.

MIT has, what, 1/5th of the global IPs? They have no crunch.

A lot of universities got in on the internet early and ended up with huge blocks of IP addresses. Stanford University had the entire 36.0.0.0/8. They gave it back, but others have not been so charitable.

I know of at least one college management system that "requires" this.

Virginia Tech's routers assign public IPs. I'm using a laptop as a server from my dorm room.

A lot of ISV's use RDP to access client machines. Most, but sadly not all, clients place serious limits on the RDP (IP of vendor only, VPN). The problem here is that RPD authentication is not required to deliver the payload and who knows if your vendor's security will avoid an infection on their end.

A really nasty attack could target small to medium ISV's with a lot of clients and use those machines to jump past firewalls.

I wonder how this affects other operating systems that implement RDP. I'm not familiar with the protocol and don't regularly use it, but is this a flaw with the protocol or with the implementation that windows uses?

Are there multiple implementations? I'm a little in the dark on this one.

It's an implementation flaw. There's no concern on others.

This is likely to impact those of us using Windows instances in EC2. The path of least resistance to access the instance is to pass RDP through the firewall. Probably a good time to start using VPC to connect to Windows instances.

Or you just ckec the checkbox that says 'more secure'?

Time to update all my computers. As long as you don't use RDP you should be ok.

What about the obvious, Windows servers / VPSs, that would have RDP enabled?

Time to relax and do nothing. I don't use Windows, :-)

Reply on news.ycombinator.com