Brute-force attacks and BlueKeep exploits usurp convenience of direct RDP connections; ESET releases a tool to test your Windows machines for vulnerable versions

Microsoft Remote Desktop disconnects from your iMac when it sleeps, because that mostly kills the network connection (and pauses processing). A possible work around is to change the Energy Saver settings so the base computer doesn’t sleep when the. Sep 02, 2013 I am not convinced this would rectify the issue, the remote desktop session is not taking place through remote web access (even though it disconnects from there as well) but using the built in remote desktop client in windows. It doesnt time out after a set period of time either, sometimes it is several minutes, 10-15 maybe, whilst at other times it is less than 5 minutes, or even seconds (20. 203 Best Answers. 274 Helpful Votes. Make sure he's using this version (free, via the Apple App store): Microsoft Remote Desktop by Microsoft Corporation. Https:/ / appsto.re/ us/ CTDLQ.i. View this 'Best Answer' in the replies below ».

I have recently configured RDS on a Win server 2012 R2 virtual machine (2x8 CPUs, 16GB RAM) Users are complaining it regularly freezes and sometimes they see the “Connection has been lost.” message in the Remote desktop connection software. At first I believed this could have been a latency issue, however it seems to affect. Keep Terminal Services & Remote Desktop From Disconnecting. I have run into many cases where my customers had a hard time with a remote desktop connection to their server disconnecting. I did all the tweaks needed to make sure terminal services and remote desktop (They are the same) didn't have a timeout limit.

UPDATE(June 29th, 2020): My colleague Ondrej Kubovič has written an update on RDP attacks identified through ESET’s telemetry through the past half-year, as well as providing additional guidance on protecting your Internet-facing systems. For more information, see his article Remote access at risk: Pandemic pulls more cyber‑crooks into the brute‑forcing game here on WeLiveSecurity. A.G.

While the BlueKeep (CVE-2019-0708) vulnerability has not, to date, caused widespread havoc, and we will be looking at the reasons why in this post, it is still very early in its exploitation life cycle. The fact remains that many systems are still not patched, and a thoroughly wormable version of the exploit might still be found. Because of these factors, ESET has created a free utility to check if a system is vulnerable.

Sometimes, you have to say something about things that “go without saying” and it seems the best way to start this post is by mentioning just that, because this is not a subject I expected to have to write about in this day and age. Before we dive in, let’s begin by looking at an old maxim.

There is an old saying in the information security field that if an adversary has physical access to your computer then it is not your computer anymore. The reason for this is quite simple: once the attackers have their hands on a computer, they can change anything they want. Installing devices such as hardware keyloggers, removing disk drives and copying them, and otherwise deleting, altering or adding anything they want on the system all become exponentially easier when you can walk right up to the computer. This is not a particularly surprising turn of events, nor a particularly clever one. Rather, it is an unavoidable truth. For the adversaries, it’s just part of their job description.

Businesses and schools and all sorts of organizations are not blind to this, though. These kinds of places do not put their servers at the front desk in the lobby, reception area, visitor center, waiting room or other locations where the public or, conceivably, any employee, faculty, student, or staff may enter and gain physical access to them. Or, at least, no business that wants to remain in business allows this. Usually, there’s some separation of the servers, whether they be in their own dedicated room, or even tucked away in some back corner that is off-limits to most personnel.

Yet for all this common knowledge, the lessons learned about security in the physical world do not always transfer well (or correctly) into the internet world. There are many servers running various versions of Microsoft Windows server operating systems that are directly connected to the internet with what amounts to little or no practical security around who can access them. And that brings us to the discussion of RDP.

What is RDP?

Windows Remote Desktop Disconnect Or Log Off

RDP, short for Remote Desktop Protocol, allows one computer to connect to another computer over a network in order to use it remotely. In a domain, computers running a Windows Client operating system, such as Windows XP or Windows 10, come with RDP client software preinstalled as part of the operating system, which allows them to connect to other computers on the network, including the organization’s server(s). A connection to a server in this case means it could be directly to the server’s operating system, or it could be to an operating system running inside a virtual machine on that server. From that connection, a person can open directories, download and upload files, and run programs, just as if using the keyboard and monitor connected to that server.

RDP was invented by Citrix in 1995 and sold as part of an enhanced version of Windows NT 3.51 called WinFrame. In 1998, Microsoft added RDP to Windows NT 4.0 Terminal Server Edition. Since then, the protocol has been a part of all versions of Microsoft’s line of Windows Server operating systems, as well as being included with all non-home user editions of Windows Client operating systems since Windows XP was released in 2001. Today, common users of RDP include system administrators doing remote administration of servers from their cubicles without having to go into the server room, as well as remote workers who can connect to virtualized desktop machines inside their organization’s domain.

What do attackers do with RDP?

For the past couple of years, ESET has seen an increasing number of incidents where the attackers have connected remotely to a Windows Server from the internet using RDP and logged on as the computer’s administrator. Once the attackers are logged into the server as administrator, they will typically perform some reconnaissance to determine what the server is used for, by whom, and when it is being used.

Once the attackers know the kind of server they have control of, they can begin performing malicious actions. Common malicious activities we have seen include:

clearing log files containing evidence of their presence on the system
disabling scheduled backups and shadow copies
disabling security software or setting up exclusions in it (which is allowed for administrators)
downloading and installing various programs onto the server
erasing or overwriting old backups, if they are accessible
exfiltrating data from the server

This is not a complete list of all the things an attacker can do, nor is an attacker necessarily going to perform all of these activities. Attackers may connect multiple times over days or just once, if they have a predetermined agenda. While the exact nature of what attackers will do varies greatly, two of the most common are:

installing coin-mining programs in order to generatecryptocurrency, such as Monero
installing ransomware in order to extort money from the organization, often to be paid using cryptocurrency, such as bitcoin

In some cases, attackers might install additional remote-control software to maintain access (persistence) to compromised servers in case their RDP activities are discovered and terminated.

We have not seen any servers that were compromised both to extort via ransomware and to mine cryptocurrency, but we have seen instances where a server was compromised by one attacker to mine cryptocurrency, then later compromised by other attackers who changed the coin miner so that the proceeds went to them, instead. It seems there is little honor among thieves.

Knowledge around RDP attacks has reached a point that even sextortion scammers are incorporating mention of it in their ransom notes in an attempt to make their scams sound more legitimate.

Figure 1. Image from sextortion email scam mentioning RDP

For more information about these types of email scams, I recommend this series of articles by my colleague Bruce P. Burrell: Part I, Part II, and Part III.

Mass RDP attacks

Attacks performed with RDP have been slowly, but steadily, increasing, and subject to a number of governmental advisories from the FBI, the UK’s NCSC, Canada’s CCCS, and Australia’s ACSC, to name a few.

However, in May 2019 the floodg

Microsoft Remote Desktop Disconnecting