Vulnerability
vulnerability:remote_desktop_exposure
Also: publicly exposed RDP
Insecure exposure of Remote Desktop to the public internet, combined in the episode with weak or reused passwords.
Insecure exposure of Remote Desktop to the public internet, combined in the episode with weak or reused passwords.
“nobody should have Remote Desktop exposed to the internet like that”
“a lot of these businesses had the same password”
Unsafe configuration in which the domain controller was directly accessible from the public internet.
“The brains of the network was accessible from anywhere in the world without a VPN.”
“Having a system running Remote Desktop right on the internet just attracts a ton of people to try to abuse the system.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | Remote Desktop | Explicit | 96 |
| incoming | EXPLOITS | Roman Seleznev | Derived | 32 |
| incoming | INITIAL_ACCESS_VIA | police department ransomware incident | Explicit | 96 |
Roman Seleznev EXPLOITS Remote Desktop exposure
Roman exploited systems with Remote Desktop exposed to the internet, according to the episode's reconstruction of his activity.
Derived Confidence 94% · Jack Rhysider EP 32 Details
“Roman would hack into Windows computers that he would find exposed online”
police department ransomware incident INITIAL_ACCESS_VIA Remote Desktop exposure
The episode attributes the ransomware access to the domain controller being exposed to the internet through Remote Desktop.
Explicit Confidence 97% · Jack Rhysider EP 96 Details
“the police department was hit with ransomware because this system was accessible from the internet”
Remote Desktop exposure AFFECTS Remote Desktop
The vulnerability is the exposure of Remote Desktop directly to the public internet.
Explicit Confidence 99% · Jack Rhysider EP 96 Details
“accessible from the internet over Remote Desktop”