BlueKeep and the servers nobody owns
Aug 15th, 2019 by Jesper Kråkhede
Two months have passed since Microsoft released the patch for BlueKeep, the RDP vulnerability in Windows 7, Server 2008 and 2008 R2. It was so serious that Microsoft even released patches for Windows XP and Server 2003, and that doesn´t happen every day.
So I have spent some time asking customers a simple question: Are you patched? The answers range from ‘Yes, of course’ to ‘We think so’ and my favourite: ‘Which servers?’
The last one is the real problem. Every company I meet has a bunch of old servers that nobody really owns. The application was bought by someone who left years ago, the vendor is gone and nobody dares to restart it. Those are exactly the ones running RDP, often with the port open to places it shouldn´t be.
There is no public exploit for BlueKeep yet, but several security researchers have shown that they can make it work. It´s a matter of time.
So, do the boring work now. Find every machine with RDP open, patch it, turn on Network Level Authentication and close 3389 towards internet. If you have to reach servers remotely use a gateway, not a hole in the firewall. And while you´re at it, write down who owns that server in the corner.
Wormable means nobody will ask for permission before it spreads.