Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

nsa.gov

Post reply on HN
Print view View original

21–30 of 40 posts

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#21

Post by tastroder »

jl6 wrote: post #20
tastroder wrote: post #19

The advisory links to https://www.nsa.gov/Portals/70/documents/what-we-do/cybersec... (PDF) I really wonder what the utility for that distribution form is, are there people printing these out? Or is there some requirement for them to generate a document ID that they could not get for plain web/HTML documents?

Do you mean to ask why is the same content published in PDF format? I quite like PDFs these days. Self-contained, archiveable, readable, sane layout, JavaScript-free, (usually) ad/cookie/tracking-free, no social media sharing buttons... the only drawback is no/poor reflow of text to fit device screen size. But I’ll live with that.

Kind of, mainly since the PDF looks different enough that it implies manual effort being involved. It felt like an odd choice but I get your points, might just be me then. Thanks.

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#22

Post by fbi-director »

tastroder wrote: post #19

The advisory links to https://www.nsa.gov/Portals/70/documents/what-we-do/cybersec... (PDF) I really wonder what the utility for that distribution form is, are there people printing these out? Or is there some requirement for them to generate a document ID that they could not get for plain web/HTML documents?

Because the NSA has an unknown exploit on Adobe Acrobat PDF Reader, and therefor wants as many downloads of this malicious pdf as possible. From people like us, in positions like us.

/s....?

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#24

Post by cm2187 »

userbinator wrote: post #3

In order to increase resilience against this threat while large networks patch and upgrade, there are additional measures that can be taken I'd say those are the first things that should be done, regardless of the presence of exploits; exposing a port/listening service to the Internet you don't need, especially one that can remotely give complete control to an attacker, is always a bad idea. Fortunately the majority…

It’s hard to run a windows server remotely without RDP. Most remote administration tools are terrible. Stupid thing like you can’t update windows using remote powershell (which also takes ages to come online after the machine booted).

Rather than disabling RDP which I think is unrealistic, I think a simple way to increase greatly the security is to set up an IP whitelist. Have a list stored on a secure and reliable location (S3 bucket for instance) and a script running every 5 minutes, looking for changes to that list. If it changed run a simple command to update the remote IP restriction to all the administrative services in the windows firewall.

No solution is bullet proof but this allows you to manage the server remotely with very little inconvenience, without requiring to set up a VPN or an internal network, and goes a long way to reduce the exposure to vulnerabilities and brute force attacks.

I would do the same thing with IPMI.

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#25

Post by close04 »

sitkack wrote: post #18

The fact that NSA does so little for cybersecurity is telling. When they say patch something, it probably means it should be national emergency.

It means that it’s good to have a backdoor you can use, it’s bad if your enemy can also use it. So the moment NSA pushes you to patch it’s because it’s no longer exclusive to them so the backdoor is no longer an asset but a liability.

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#26

Post by nocturnial »

I know we should always assume good faith.

From all the vulnerabilities they know, they chose to publish one that's known and only concerns outdated software. Maybe I'm too skeptical but when the NSA starts leaking fixes for zero day exploits, I'll take them more seriously.

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#27

Post by alamortsubite »

cm2187 wrote: post #24
userbinator wrote: post #3

In order to increase resilience against this threat while large networks patch and upgrade, there are additional measures that can be taken I'd say those are the first things that should be done, regardless of the presence of exploits; exposing a port/listening service to the Internet you don't need, especially one that can remotely give complete control to an attacker, is always a bad idea. Fortunately the majority…

It’s hard to run a windows server remotely without RDP. Most remote administration tools are terrible. Stupid thing like you can’t update windows using remote powershell (which also takes ages to come online after the machine booted). Rather than disabling RDP which I think is unrealistic, I think a simple way to increase greatly the security is to set up an IP whitelist. Have a list stored on a secure and reliable l…

I'm not a sysadmin, but it seems even safer and easier to 1) keep Windows behind NAT, 2) ssh port forward through UFW on a cheap Linux box.

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#28

Post by cm2187 »

alamortsubite wrote: post #27
cm2187 wrote: post #24

Earlier quoted context omitted.

It’s hard to run a windows server remotely without RDP. Most remote administration tools are terrible. Stupid thing like you can’t update windows using remote powershell (which also takes ages to come online after the machine booted). Rather than disabling RDP which I think is unrealistic, I think a simple way to increase greatly the security is to set up an IP whitelist. Have a list stored on a secure and reliable l…

I'm not a sysadmin, but it seems even safer and easier to 1) keep Windows behind NAT, 2) ssh port forward through UFW on a cheap Linux box.

If you have the luxury to do that, but if you run a VM, or a single box in colocation, or rent a physical server, that may not be an option. My point is introducing an IP whitelist inside the server doesn't require to change the physical set up, nor any current process relying on the server being directly accessible. It's a low cost quick win.

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#29

Post by crankylinuxuser »

userbinator wrote: post #3

In order to increase resilience against this threat while large networks patch and upgrade, there are additional measures that can be taken I'd say those are the first things that should be done, regardless of the presence of exploits; exposing a port/listening service to the Internet you don't need, especially one that can remotely give complete control to an attacker, is always a bad idea. Fortunately the majority…

Even nat won't save you. Most NAT assumes unlimited outbound 0.0.0.0/0 tcp/udp/icmp . Almost all configuration is that permissive.

And I just need 1 packet to puncture.

https://samy.pl/pwnat/

Re: NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Windows

#30

Post by userbinator »

crankylinuxuser wrote: post #29
userbinator wrote: post #3

In order to increase resilience against this threat while large networks patch and upgrade, there are additional measures that can be taken I'd say those are the first things that should be done, regardless of the presence of exploits; exposing a port/listening service to the Internet you don't need, especially one that can remotely give complete control to an attacker, is always a bad idea. Fortunately the majority…

Even nat won't save you. Most NAT assumes unlimited outbound 0.0.0.0/0 tcp/udp/icmp . Almost all configuration is that permissive. And I just need 1 packet to puncture. https://samy.pl/pwnat/

NAT traversal is possible if you happen to be in control of the machines behind the NAT --- that's not very relevant here, since it requires running a special server on the machine you want to exploit (and if you can already do that, i.e. run code on the machine, then there's no point in exploiting RDP...)

The scenario I'm referring to, and the one the article describes, is a remote attacker trying to connect to port 3389 of a machine behind a NAT --- without being able to already access the machine in the first place. In other words: you have a public IP X; there's a machine with private IP Y (which you don't know but may be able to guess easily) behind its NAT. No ports are forwarded. You have no access to the machine. How do you establish a connection to port 3389 (or for that matter, any other listening port) on it?

Post reply on HN