An important new article from Susan Bradley in CIO Online: https://www.youtube.com/watch?v=J9Cyi_exdJM BlueKeep and DejaBlue are both potent threats.
[See the full post at: Patch Lady – How to avoid using RDP in Windows]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
Patch Lady – How to avoid using RDP in Windows
- This topic has 54 replies, 22 voices, and was last updated 4 years ago.
AuthorViewing 18 reply threadsAuthor-
Hi Woody, thank you for being there for us and having your MVPs and this site.
You mentioned, “In Vista or Win7, click My Computer and choose Computer. At the top, click System properties. On the left, click Remote Settings. You should be on the Remote tab, and the button under Remote Desktop marked “Don’t allow connections to this computer” should be selected. If it isn’t, click it and click OK.”
But on my Windows 7 Home Premium under System Properties, the Remote tab has, “Allow Remote Access connections to this computer” and one would uncheck that to prevent it.
Thank you again.
-
The Remote Tab contains two (2) items:
1. Remote Assistance (checkmark to Allow)
2. Remote Desktop (Select dot one of three)Windows 10 Pro x64 v22H2 and Windows 7 Pro SP1 x64 (RIP)1 user thanked author for this post.
-
Both of those 2 settings rate an Article that explicitly states just what Windows/Third Party software makes use of that”
“1. Remote Assistance (checkmark to Allow)
2. Remote Desktop (Select dot one of three)”That Remote Assistance is according to MS’s included link in the System Properties Panel/Remote Assistance Tab:
“What happens when I enable Windows Remote Assistance?
When you enable Windows Remote Assistance:
You can get help using Windows Remote Assistance.
Windows Remote Assistance is allowed through Windows Firewall so that it can communicate with your helper’s computer. For more information, see What are the risks of allowing programs through a firewall?”
And under that there is more under another link, What are the risks of allowing programs through a firewall? so that’s:
“What are the risks of allowing programs through a firewall?
When you add a program to the list of allowed programs in a firewall, or when you open a firewall port, you allow a particular program to send information to or from your computer through the firewall. Allowing a program to communicate through a firewall (sometimes called unblocking) is like punching a hole in the firewall.
Each time you open a port or allow a program to communicate through a firewall, your computer becomes a bit less secure. The more allowed programs or open ports your firewall has, the more opportunities there are for hackers or malicious software to use one of those openings to spread a worm, access your files, or use your computer to spread malicious software to others.
It’s generally safer to add a program to the list of allowed programs than to open a port. If you open a port, it stays open until you close it, whether or not a program is using it. If you add a program to the list of allowed programs, the “hole” is open only when needed for a particular communication.
To help decrease your security risk:
Only allow a program or open a port when you really need to, and remove programs from the list of allowed programs or close ports that you no longer need.
Never allow a program that you don’t recognize to communicate through the firewall.”
-
-
-
Good suggestions!
I wish I felt more comfortable in saying “If you don’t allow remote connections on the Remote tab you’re protected from BlueKeep and DejaBlue.”
That should be true, but I still haven’t found anybody who knows the Blues intimately who’s just come out and said it. For now, blocking RDP is an obvious first step – which every Windows user can follow.
5 users thanked author for this post.
-
Microsoft does in their ATP documentation:
- Customers that don’t turn on Remote Desktop Services are not exposed to exploits for these vulnerabilities. Remote Desktop Services is off by default on affected platforms.
August 2019 RDP update advisory
Executive summary
As part of the August 2019 Security Updates, Microsoft released fixes for unauthenticated remote code execution vulnerabilities (CVE-2019-1181 and CVE-2019-
1182) in Remote Desktop Services on Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016. Attackers might weaponize these vulnerabilities to launch various attacks, including disruptive attacks that cause affected systems to crash. Customers should prioritize the deployment of critical updates to all affected platforms. If updating immediately isn’t an option, consider turning off Remote Desktop Services. Where Remote Desktop Services is required, turn on network-level authentication (NLA) for RDP to mitigate malicious client machines attacking servers.
Key insights
- Successful exploits of these vulnerabilities could be used to gain remote access to vulnerable systems.
- Microsoft has not observed, at the time of publication, any attacks exploiting these vulnerabilities in the wild.
- Customers with Remote Desktop Services enabled and network-level authentication turned off are at higher risk for attack. Machines in this configuration that are exposed to the internet are at the highest risk. Turning on network-level authentication for RDP significantly mitigates known remote vectors for exploitation for servers.
- Customers evaluating the risks posed by these vulnerabilities should account for potential attacks within their networks. Past malware has used similar vulnerabilities to spread within enterprise environments after gaining a foothold within the network.
Mitigations
Apply these mitigations to reduce the impact of the vulnerabilities.
- Machines running Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012 R2, Windows 10, or Windows Server 2016 should apply fixes for CVE-2019-1181 and CVE-2019-1182. These fixes are available as part of the August 2019 Security Updates.
- Machines running Windows Server 2008 are not vulnerable.
- Customers that don’t turn on Remote Desktop Services are not exposed to exploits for these vulnerabilities. Remote Desktop Services is off by default on affected platforms.
- Enable network level authentication (NLA) for RDP. This will help mitigate attacks against machines running Remote Desktop Services by changing the requirement to exploit from unauthenticated access to authenticated access.
- Reduce the risk to internet-facing machines with Remote Desktop Services enabled by placing them behind an authenticated gateway or a firewall.
- Turn on cloud-delivered protection and automatic sample submission on Windows Defender Antivirus. These capabilities use artificial intelligence and machine learning to quickly identify and stop new and unknown threats.
Detection details
Endpoint detection and response (EDR)
The following alert can indicate threat activity related to exploitation of these vulnerabilities. This alert might fire for other suspicious but unrelated network activity and is not monitored as part of this report.
- Suspicious number of outbound network connections — this alert flags spikes in the number of outbound connections to the common RDP port (TCP/3389). These connections can indicate port scanning or worm-like behavior that might be abusing these vulnerabilities.
Advanced hunting
The following query finds processes with unexpected connections to the common RDP port (TCP/3389). It filters out common RDP programs and scanning tools. It also provides contextual information, such as the names and IP addresses of the machines involved in the connections.
You can use it to find processes that might be scanning for possible targets or exhibiting worm-like behavior.
// Find unusual processes with outbound connections to TCP port 3389 NetworkCommunicationEvents | where RemotePort == 3389 | where ActionType == "ConnectionSuccess" and Protocol == "Tcp" | where InitiatingProcessFileName !in~ //Remove common RDP programs ("mstsc.exe","RTSApp.exe", "RTS2App.exe","RDCMan.exe","ws_TunnelService.exe", "RSSensor.exe"," RemoteDesktopManagerFree.exe", "RemoteDesktopManager.exe", "RemoteDesktopManager64.exe"," mRemoteNG.exe","mRemote.exe"," Terminals.exe", "spiceworks-finder.exe"," FSDiscovery.exe"," FSAssessment.exe", "chrome.exe", "microsodeedgecp.exe", "LTSVC.exe", "Hyper-RemoteDesktop.exe", "", "RetinaEngine.exe", "Microsoft.Tri.Sensor.exe" ) and InitiatingProcessFolderPath !has "program files" and InitiatingProcessFolderPath !has "winsxs" and InitiatingProcessFolderPath !contains "windows\\sys" | where RemoteIP !in("127.0.0.1", "::1") | summarize ComputerNames = make_set(ComputerName), ListofMachines = make_set(MachineId), make_set(EventTime), ConnectionCount = dcount(RemoteIP) by InitiatingProcessFileName, InitiatingProcessSHA1, bin(EventTime, 1d) References
- CVE-2019-1181 | Remote Desktop Services Remote Code Execution Vulnerability. Microsoft (accessed 2019-08-14)
- CVE-2019-1182 | Remote Desktop Services Remote Code Execution Vulnerability. Microsoft (accessed 2019-08-14)
- Patch new wormable vulnerabilities in Remote Desktop Services (CVE-2019-1181/1182). Microsoft (accessed 2019-08-14)
Change log
- 2019-08-15 20:47 UTC | Enhanced advanced hunting query
- 2019-08-15 05:15 UTC | Entry created
Susan Bradley Patch Lady/Prudent patcher
5 users thanked author for this post.
These are a couple of extra/precautionary steps I’ve taken and checked on Win7 x86/x64 installations.
Patch Lady mentioned in the video, blocking port 3389 using your firewall if you do not use RDP at all. I’ve blocked the incoming port 3389 in both Windows 7 and 8.1
This port is used in the RDP protocol and blocks attempts to establish a connection.(better safe than sorry)Also mentioned was NLA and Windows 7 Home Premium has no GPedit so..
To check and ensure Network Level Authentication is ONWithin Regedit, navigate to the following keys and check that the data value is set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
Value: UserAuthentication
Data: 1HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\
Value: UserAuthentication
Data: 1No problem can be solved from the same level of consciousness that created IT- AE4 users thanked author for this post.
-
-
Win8.1: go to Control Panel/Windows Firewall and open it up.
LHS panel: Advanced Settings (opens up new window)
LHS panel: click Inbound Rules
RHS panel: click New Rule (opens new window)
Click on Port Radio button then click Next
Select TCP radio button and input specific remote port as 3389 then click Next
Select Block the connection radio button then click Next
Tick all Private Domain and Public then click Next
give it a rulename 3389 and click FinishNo problem can be solved from the same level of consciousness that created IT- AE1 user thanked author for this post.
-
-
Here:
On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefenderOur shop has disabled RDP in every PC we sell or service, unless the customer needs it, which is very rare with superior options available. We saw this as a potential vulnerability decades ago. I’m surprised it took so long to actually (theoretically) become one.
GreatAndPowerfulTech
4 users thanked author for this post.
Most people, even if RDP is enabled, would not be able to access it from the outside since most consumer-level ISP modems and routers have NAT and port 3389 (the RDP port) is not open.
Obviously there are the network techies out there like myself who know how to open this, but I would hope that we are smart enough to provide a workaround either via VPN or SSH tunneling, which is what I’ve done on my home setup. I have a custom SSH port open but my Bitvise SSH Server is locked down as tight as it can be. I SSH in with PuTTY and then RDP to anything on my internal home network, with practically no care (or scare) in the world.
For average Joe and Jane user, if you need to remotely access a system, use Chrome Remote Desktop, or Teamviewer.
1 user thanked author for this post.
-
zero2dash said:
For average Joe and Jane user, if you need to remotely access a system, use Chrome Remote Desktop, or Teamviewer.Another option is AnyDesk, which is no-install & free for personal use (with some limitations, eg. maximum of 1 connection at any one time, max 30 mins’ connection per session).
That being said, any sort of remote desktop connection tool — if improperly configured & used carelessly on a poorly secured network — can be a point of entry for attack.
For instance, the backend supply-chain hack of CCleaner in 2017 was enabled by TeamViewer, which the hackers used to infiltrate the Piriform network via an unattended PC.
Subsequently, the hackers roamed around the Piriform network, & successfully logged in as administrator to various PCs using the Windows Remote Desktop connection.
1 user thanked author for this post.
-
-
IMHO the “once they get inside you are toast” is generally true of everything these days. See the ransomware hit on umpteen Texas small cities as an example. We just need time to patch, not absolute security.
Susan Bradley Patch Lady/Prudent patcher
1 user thanked author for this post.
-
Just out of curiosity, In W10 Pro with Remote Desktop off does the Remote Assistance check box actually do anything? I would think not but …
[BTW its Dameware from Solarwinds (which bought Dameware) now. Who would think that Solarwinds is a 4 1/ Billion $ company.]
Is Teamviewer (the Civic ) still recommended ? I remember that was a favorite at one time .
🍻
Just because you don't know where you are going doesn't mean any road will get you there.1 user thanked author for this post.
-
-
-
Hey Y’all,
I’ve used TeamViewer free version for years to fix friends and family computers all over the world and have never had a problem, just lucky I guess.
1 user thanked author for this post.
Microsoft does in their ATP documentation: Customers that don’t turn on Remote Desktop Services are not exposed to exploits for these vulnerabilities. Remote Desktop Services is off by default on affected platforms.
I wonder if there might be a caveat associated with this statement from Microsoft. Microsoft’s statement makes no mention of Remote Assistance. Microsoft’s statement might assume that the user is also using Windows Firewall and not a third party firewall which could still be passing RDP port 3389. From my understanding, if stuff through RDP port 3389 isn’t blocked, then the specific unpatched DLL is exploitable.
Here is a trick that I learned in terms of third party firewalls: Some third party firewalls do not pickup newly configured rules in Windows Firewall if Windows Firewall is disabled. This sometimes can cause weird networking issues. For example, Panda’s firewall has this issue. The solution is to temporarily disable the third party firewall, then enable Windows Firewall, and then enable the third party firewall. The third party firewall should then pick up the new rules in Windows Firewall. Most third party firewalls then automatically disable Window Firewall. Panda’s firewall, for example, will pick up the new rules in Windows Firewall and then disable Windows Firewall when Panda’s firewall is re-enabled. I consider this to be a bug with an easy workaround.
If anyone is afraid to install the August updates, you should be able to block port 3389 in your home router or ISP provided modem/router. Remember to block port 3389 for all protocols, specifically HTTP and UDP.
1 user thanked author for this post.
-
Remote assistance uses port 3389, same as remote desktop protocol. Worse, it attempts to use uPNP on your firewall to create a port forwarding rule for 3389 on your external firewall to your computer.
~ Group "Weekend" ~
2 users thanked author for this post.
-
-
I am rather curious too, esp since I just thought to go look at something – an old router.
The way it’s supposed to work, if you send a remote assistance request, along with the request Windows tries to use uPnP on your router to open that port. In theory, uPnP sessions are supposed to expire. In reality I’ve seen plenty of times where that doesn’t work.
And sure enough. On a loaner router sitting in my storage, booted up tonight and looked at the uPnP tables . . . and there were several port forwarding rules listed for 3389 to specific internal IP’s.
(Among other things, this is why I generally turn uPnP off on my regular stuff. This was a loaner that really never got configured to my standards.)
So the question I have for Microsoft is:
Given a scenario with Windows Home (no official RDP), with Remote Assistance on, and RA has been used at least once on a router that has uPnP enabled . . .
Vulnerable to Bluekeep? Yes? No?
I’m betting on yes.
~ Group "Weekend" ~
4 users thanked author for this post.
-
And I will bet 99.99 percent on Yes.
1 user thanked author for this post.
-
-
-
-
I wish we could get definitive statements about blocking BlueKeep and the DejaBlues – is it sufficient to turn off RDP in the GUI? is it sufficient to block 3389? – but there don’t appear to be any forthcoming.
Based on what I’ve seen, I’m not 100% sure that enabling NLA will keep the DejaBlues off a network (besides, neophytes messing around with NLA can lead to all sorts of problems).
Also, 3389 is the default RDP port – but it can be reassigned.
-
NLA requires that the user be authenticated to the target workstation before a RDP session is created on that target. When NLA is NOT enabled, queries to port 3389 start the RDP session immediately, and then authentication is presented. That’s why Microsoft listed that as the first mitigation.
~ Group "Weekend" ~
-
-
Here’s how it works for Win8.1 Home (no Premium):
- Since there’s no “My Computer”, click the File Explorer icon on the Desktop Taskbar. (If you’re on the Start screen [UWP apps], click Search, then enter “File Explorer” in the Search box & click File Explorer in the Search results.)
- At the top, click “Computer” to get the ribbon. On the ribbon, click “System properties” on the far right. Here’s the resulting screen:
On the left, click Remote Settings. You should be on the Remote tab, and the check box under Remote Assistance marked “Allow Remote Assistance connections to this computer” is probably checked. If it is, uncheck it and click OK.
Bought a refurbished Windows 10 64-bit, currently updated to 22H2. Have broke the AC adapter cord going to the 8.1 machine, but before that, coaxed it into charging. Need to buy new adapter if wish to continue using it.
Wild Bill Rides Again...Checking Your RDP Status
- Go to the GRC page.
- Click Services > ShieldsUp.
- Click “Proceed”, in the middle of the page.
- Type “3389” in the text box in the middle of the screen.
- Click “User Specified Custom Port Probe”.
A green “Passed” stamp is the correct response.
If you get anything else pop in and ask us for help.cheers, Paul
4 users thanked author for this post.
-
YES. That’s the link I was looking for. Appreciate it!
1 user thanked author for this post.
-
Paul T said:
4. Type “3389” in the text box in the middle of the screen.
5. Click “User Specified Custom Port Probe”.Direct link to probe a single specific port (eg. 3389 — or whatever custom number it has been reassigned to): https://www.grc.com/x/portprobe=3389
The ideal result should be: “Stealth” (green background), ie. the port does NOT respond at all to probes, & thus seemingly does not exist. Any response (including telling the world that the port is closed) is not ideal.
2 users thanked author for this post.
-
-
I don’t know which “setting” you are referring to wrt the clip you copied from my comment above, but the Firefox and HP Printer installers added the inbound allow access rules to Windows Firewall (WF) without asking or informing me (as far as I can remember). It was only by chance when I looked at the WF settings sometime later that I spotted these allow rules.
To see the WF inbound rules (if that is what you are asking me?), in the Control Panel select the “Windows Firewall” option and then the “Advanced settings” option on the left hand side (LHS). In the “Windows Firewall with Advanced Security” window which opens, in the LHS pane select Inbound Rules and the middle pane shows the rules. By default this is all rules whether these are enabled or not. You can use the “Filter by State” options on the RHS pane to just display a subset of rules if you prefer.
I had deleted my HP Printer inbound rules after installation – it is an old printer and I don’t expect to have any communications with HP about it and I connect it to a PC using a USB cable. I forget if I also deleted the Firefox rule(s) as well, but present now is a Disabled “allow” rule for C:\Program Files\Mozilla Firefox\firefox.exe for the Private profile (which makes me think that this is intended for some communication between Firefox instances on different PCs in a local network, not via the wider internet which I assume would need a Public profile inbound rule?) and the TCP protocol for all Ports. I don’t remember if I disabled this Firefox rule or if the Firefox installer did – sorry!
Anyway my main point was that I expect the “Block all incoming connections …” setting to override any enabled inbound “allow” rules setup here for anything, but in several years of experience with this setting I have seen no side-effects. Again my usual caveat: I’m just a simple PC user not attempting any complicated local networking 🙂
HTH. Garbo.
1 user thanked author for this post.
-
-
TeamViewer does not use RDP or the RDP port. You can continue to use TV without issue.
cheers, Paul
1 user thanked author for this post.
-
Off Topic But it’s really unfortunate non AskWoody Plus members can no longer use the Master Patch List.
1 user thanked author for this post.
-
I appreciate your concern, but….
We’re trying hard to make enough money to keep the site (and the Patch List) going. This is the first step. Shortly — maybe early next week — we’ll be limiting the latest Newsletter to Plus members, also.
I’ve waited more than six months to make the transition. Probably shouldn’t have waited that long.
Keep in mind that we’re still on the donation model – you can choose how much to donate for a one year’s membership.
1 user thanked author for this post.
Viewing 18 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Microsoft’s massive Windows 11 update, featuring Copilot AI, begins rolling out
by 11 minutes ago
-
MailStore Home updates
by 13 hours, 56 minutes ago
-
T-Mobile users say they see other people’s account information
by 1 day, 1 hour ago
-
Retirement of Exchange Web Services in Exchange Online
by 1 day, 13 hours ago
-
What Remote Desktop credentials do I use to access a MS Account computer
by 2 hours, 40 minutes ago
-
Office 2003 Compatibility with One Drive in Windows 11
by 2 days ago
-
Has KB5030219 been pulled for Windows 11 Pro for Workstations?
by 2 hours, 55 minutes ago
-
By default encryption on Apple
by 1 day, 17 hours ago
-
KB5029331 Macrium/Reflect
by 1 day, 19 hours ago
-
Windows 10 Build 19045.3513 (22H2) to Release Preview Channel
by 2 days, 6 hours ago
-
Microsoft worker accidentally exposes 38TB of sensitive data in GitHub blunder
by 1 day, 15 hours ago
-
Change CPU/Mainboard without reinstallation of OS and Apps – Win10
by 1 day, 20 hours ago
-
Mouse slows to crawl if Edge in focus
by 3 days, 1 hour ago
-
Windows and Surface chief Panos Panay is leaving Microsoft
by 2 days, 15 hours ago
-
Essential Office Portable
by 3 days, 3 hours ago
-
Essential Office: Disable Spell Check
by 3 days, 3 hours ago
-
Apple 2030
by 1 day, 1 hour ago
-
Wi-Fi 7? Why not!
by 48 minutes ago
-
Second city — the AI view from Washington
by 3 days, 12 hours ago
-
Zeroing in on zero days
by 1 day, 21 hours ago
-
LMDE – Software Update
by 1 day, 2 hours ago
-
MacAfee anti virus left overs
by 21 hours, 26 minutes ago
-
Google issues update for Chrome 109 (Win 7 – Server 2012r2) that fixes WebP
by 2 hours, 12 minutes ago
-
Microsoft apparently canning P2P Win32 services on Windows 11 23H2, Windows 12
by 3 days, 22 hours ago
-
Inserting from clipboard into posting
by 3 days, 21 hours ago
-
Background picture not invoked @ startup
by 2 days ago
-
download Linux Mint most recent
by 4 days, 5 hours ago
-
Modify email account settings
by 4 days, 13 hours ago
-
Microsoft’s Edge 109 updates for Windows 7 , 8, 8.1, 2012 R2 ! webP fix
by 5 days, 3 hours ago
-
High CPU Temperatures (Stock Cooler Insufficient)
by 5 days, 11 hours ago
