Posted by Mike Beagles
As part of our effort to inform our clients about potential and serious cybersecurity issues, MCP provides advisories about vulnerabilities and exploits that could threaten the operations of their critical communications networks. Sign up to receive these advisories in your inbox as soon as they are released.
This week there is a new critical alert that requires the mission-critical community’s immediate attention.
Hacker group UAS recently had 1.3 million Remote Desktop Protocol (RDP) credentials, i.e., usernames and passwords, for Windows servers leaked by security researchers. The compromised credentials could allow a cyberattacker to log into a compromised RDP server. It is imperative to apply best security practices when handling Windows RDP servers, to prevent cyberattackers from accessing confidential information and granting more insight into a network. Such practices include a strong password policy and ensuring that RDP in not open to the internet.
The affected servers affected would be exposed to cyberattackers logging in with these compromised credentials. Logging in via RDP is an easy way for an attacker to access confidential information stored within the internal network, pivot within the network, and possibly perform other malicious tasks. The Federal Bureau Of Investigation (FBI) has reported that RDP is responsible for 70-80 percent of all network breaches.
This threat is especially noteworthy due to the high risk that derives from compromised credentials. Once logged into the network, a cyberattacker can deploy various methods to maintain persistence or cause havoc within the network. The security researchers had access to the database for more than three years and shared it with Vitali Kremez, who in turn launched a service called RDPwned, which enables companies and their administrative staffs to determine whether their servers are listed in the database. It is absolutely imperative to ensure that RDP servers are protected—strong password policies are one of the best ways to prevent breaches like this from occurring.
Once an attacker has been granted access to the network via compromised RDP credentials, the attacker can perform various malicious activities. Maintaining persistence to gather more confidential information may be some attackers’ goals, but others may want to wreak havoc and destroy business operations. For example, cyberattackers could deploy ransomware within the network or destroy important data that is critical to business functions. Others could use their access to the network to steal credit card information or create backdoors for other attackers to access.
For more in-depth information about the recommendations, please visit the following links: