https://twitter.com/MalwareTechBlog/status/1190730471321112577?s=19
Honeypots detected RDP based worm out in the wild
Not sure on patch version
edit blog posts, not a worm:
https://doublepulsar.com/bluekeep-exploitation-activity-seen-in-the-wild-bd6ee6e599a6
https://www.kryptoslogic.com/blog/2019/11/bluekeep-cve-2019-0708-exploitation-spotted-in-the-wild/
Posted Nov 2, 2019, 8:52 PM UTC · edited
Whoever connects RDP straight to the internet, such a person / organisation deserves to be compromised and hacked to oblivion.
:-( I'm not on my orgs cloud team but I've found it from our cloud side
Thanks shoidan
I guess one of us should put the blog post up Monday morning
I have 3389 blocked and all our users have to VPN in if they want to RDP.
How it should be ;)
RDP with no other precautions, maybe. There are mitigations.
Like requiring you access it over a VPN!
Still wont save you if someone brings in an infected system + business with bad firewall/segmentation policies.
PATCH PEOPLE!
but... but... they told me brute force protection was enough...
The thread by Kevin and analysis by malware tech is interesting. Something is going after those machines for sure. This is why RDP has no reason to be exposed to the internet. Hell, I'd like to disable it internally.
Kevin Beaumont posted today that the bluekeep proof of concept exploit had a bug that caused machines with RDP to crash rather than return interesting data, metasploit are fixing that bug, this means that it is going to become a lot more serious.
Well good that MS gave us the patch months ago at least. From what Wired are writing on the issue.
Also the fact that MS gave XP an path is not a good sign of how much XP is still out there.
Aren't there a number of large companies that pay insane amount of money to still get xp support?
I think even extended support for XP is dead now
It is, January 2019 I think was the last date for it. Note that 2008/windows 7 is EOL January 2020.
EOL, but extended support is available until 2023
Not sure how long it lasted for xp but paid support should last till 2023 for windows 7
Every bank in Australia.
Wouldn't be surprised if it's every bank ever, either that or fortran running on an IBM mainframe
I believe that the US navy was paying for support past the extended expiry date.
There are still Windows 2000 servers out there hosting websites.
just checked, shodan shows 1.8K Win XP machines with 3389 internet facing and maybe 5-8K 2008R2...
XP