Two months have passed since Microsoft released the patch for BlueKeep, the RDP vulnerability in Windows 7, Server 2008 and 2008 R2. It was so serious that Microsoft even released patches for Windows XP and Server 2003, and that doesn\u00b4t happen every day.<\/p>\n
So I have spent some time asking customers a simple question: Are you patched? The answers range from \u2018Yes, of course\u2019 to \u2018We think so\u2019 and my favourite: \u2018Which servers?\u2019<\/p>\n
The last one is the real problem. Every company I meet has a bunch of old servers that nobody really owns. The application was bought by someone who left years ago, the vendor is gone and nobody dares to restart it. Those are exactly the ones running RDP, often with the port open to places it shouldn\u00b4t be.<\/p>\n
There is no public exploit for BlueKeep yet, but several security researchers have shown that they can make it work. It\u00b4s a matter of time.<\/p>\n
So, do the boring work now. Find every machine with RDP open, patch it, turn on Network Level Authentication and close 3389 towards internet. If you have to reach servers remotely use a gateway, not a hole in the firewall. And while you\u00b4re at it, write down who owns that server in the corner.<\/p>\n
Wormable means nobody will ask for permission before it spreads.<\/p>\n","protected":false},"excerpt":{"rendered":"
Two months have passed since Microsoft released the patch for BlueKeep, the RDP vulnerability in Windows 7, Server 2008 and 2008 R2. It was so serious that Microsoft even released patches for Windows XP and Server 2003, and that doesn\u00b4t happen every day. So I have spent some time asking customers a simple question: Are […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[35,37,36],"class_list":["post-1043","post","type-post","status-publish","format-standard","hentry","category-security-architecture","tag-bluekeep","tag-patching","tag-rdp"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1043","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1043"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1043\/revisions"}],"predecessor-version":[{"id":1055,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1043\/revisions\/1055"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}