OnDemand Training - Best Special Offers of the Year Ending Soon - Learn More


Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS Institute Identifies 30% Increase in Attacker Interest in Remote Desktop Protocol (RDP) During Month of March

Findings indicate risk to companies that have quickly enabled remote working via RDP during COVID-19 outbreak

  • Bethesda, MD
  • April 7, 2020

SANS Institute, the global leader in cyber security training and certifications, has identified a 30% increase in attacker interest in Remote Desktop Protocol (RDP) servers during the month of March 2020. This increase coincides with a significant increase in exposed RDP servers, as measured by Shodan, the search engine that allows users to search the internet for connected devices.

The findings for March are concerning, as they also coincide with the massive surge in companies worldwide that needed to close offices and quickly stand up remote workforces to comply with social distancing restrictions due to the rapid spread of COVID-19. The concern is that, in order to quickly and inexpensively enable employees to work from home, some organizations have implemented RDP, which can expose confidential systems to the public internet.

Dr. Johannes Ullrich, SANS fellow and Dean of Research at the SANS Technology Institute, explains further: “The number of source IP addresses attackers used to scan the internet for RDP increased by about 30% during March, from an average of 2,600 attacking IP addresses to around 3,540 each day in March. RDP is not a protocol that is robust enough to be exposed to the internet. Consequently, we are now seeing attackers actively trading weak credentials which they have identified for these RDP servers. A compromised RDP server can lead to a complete compromise of the exposed system and will likely be used to attack and exploit additional systems inside the network.”

Remote Desktop Protocol (RDP) is a protocol developed by Microsoft, which provides users with a graphical interface to connect to another computer over a network connection. It is a cheap and simple way for companies to enable remote working for employees. The user employs RDP client software for this purpose, while the other computer must run RDP server software.

For companies that have implemented RDP, Ullrich advises: “Use unique, long, and random passwords to secure your RDP servers, and if possible, only provide access via a VPN. Microsoft also offers RDP Gateway, which can be used to implement strong authentication policies. You may attempt to limit access to RDP from specific IP addresses if you are not able to implement a VPN right now, but this may be difficult if your administrators are currently working from home with dynamic IP addresses.

“Another option is to use a cloud server as a jump-off point,” Ullrich continued. “Whitelist the cloud server and use secure protocols like SSH to connect to the cloud server. This technique may work as a quick fix if you do not want to risk downtime while everybody is working remotely. Many organizations are currently not willing to risk a loss of access to business-critical systems. Modifying remote access and firewall rules may lead to a loss of access that, in some cases, can only be restored by on-site personnel.”

Recognising that coronavirus has caused organizations around the world to transition their workforce away from an office to work-from-home environment, and that many organizations lack the policies, resources, or training to enable their people to do so securely, SANS released the “Securely Working from Home” Deployment Kit on March 16. This free kit provides organizations with a step-by-step guide on how to rapidly deploy a training program for their remote staff. All training materials and resources necessary to secure a remote, multi-lingual workforce are included in the kit.

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 60 courses at In-Person and Live Online cyber security training events, and more than 50 courses are available anytime, anywhere with our OnDemand platform. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers a master’s degree, graduate certificates, and an undergraduate certificate in cyber security. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to easily and effectively manage their ‘human’ cybersecurity risk. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system – the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. (https://www.sans.org)