In July I wrote that BlueKeep was a matter of time. On the 2nd of November security researcher Kevin Beaumont saw his honeypots crash, and it turned out that someone was using BlueKeep to install cryptocurrency miners on exposed RDP servers.<\/p>\n
The good news is that this was not the big worm everyone feared. It looks like somebody took a publicly available exploit and scanned internet for easy targets, and in some cases the exploit just crashed the machines.<\/p>\n
The bad news is that the exploit is public and there are still a lot of unpatched machines out there. Next time it might not be a miner. And remember that the next attacker may not come from internet. Once someone is inside your network, every unpatched server with RDP is an open door to the next one.<\/p>\n
So, same advice as in July, only more urgent. Patch. Turn on Network Level Authentication. Close RDP towards internet. And then look inside: Which servers can reach which other servers on 3389? Does every server really need to accept RDP from every client? Use the Windows firewall to restrict it to your admin workstations.<\/p>\n
Six months between patch and exploitation is a gift. Don\u00b4t waste the next one.<\/p>\n","protected":false},"excerpt":{"rendered":"
In July I wrote that BlueKeep was a matter of time. On the 2nd of November security researcher Kevin Beaumont saw his honeypots crash, and it turned out that someone was using BlueKeep to install cryptocurrency miners on exposed RDP servers. The good news is that this was not the big worm everyone feared. It […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[13],"tags":[35,37,36],"class_list":["post-1051","post","type-post","status-publish","format-standard","hentry","category-technology","tag-bluekeep","tag-patching","tag-rdp"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1051"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1051\/revisions"}],"predecessor-version":[{"id":1063,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1051\/revisions\/1063"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}