The reason Remote Desktop Protocol (RDP) seems to be around forever is because it has (at least compared to many technologies that have risen and fallen in just a few short years). An early version known as “Remote Desktop Protocol 4.0” was released in 1996 as part of Windows NT 4.0 Terminal Server Edition and allowed users to remotely access and control Windows-based computers over network connections. Now
In recent decades, RDP has become a widely used protocol for remote access and management of Windows-based systems. RDP has played a key role in enabling remote work, IT support, systems administration, and has served as the foundation for many remote desktop and virtual desktop infrastructure (VDI) solutions.
A downside to the widespread use of RDP is that a remote code execution (RCE) vulnerability in the RDP gateway can have serious consequences, causing significant damage and potentially compromising the security and integrity of the affected system. There is something. From an attacker’s perspective, exploitation of the RCE vulnerability is a method of achieving unauthorized access to the affected system, allowing the attacker to gain control of the system, bypass security measures, lateral movement, data exfiltration, Malicious actions such as malware can be performed. installation, system disruption, etc.
It is important to note that the severity of impact depends on many factors, including the specific vulnerability, the intent and capabilities of the attacker, the criticality of the system targeted, and the security measures in place. Nonetheless, given the potential for unauthorized access, data breaches, and system compromise, RDP’s RCE vulnerability is considered a critical security concern that requires immediate response and mitigation.
To my surprise (I’m kidding), Microsoft recently released a security bulletin for just such a scenario. Please patch it!
DLL hijack used to exploit RDP – CVE-2023-24905
Using a dynamic link library (DLL) hijack, the RDP client was compromised when it attempted to load files from the current working directory (CWD) instead of the Windows OS directory.
From the researcher’s blog:
“We have discovered that by changing the icon and strings in the DLL, we can spoof the loaded resource. This makes for an interesting phishing attack vector. In this scenario, the attacker could use the icon and strings, etc. For example, by changing icons or strings, an attacker can make an error message look like a legitimate system notification or perform a dangerous action (such as downloading a file). It may transform it into something seemingly harmless (e.g. file download, running software update).
RCE results from changing a DLL string into a malicious file, placing it on a commonly accessed file share location, and tricking users into running that file. Interestingly, this exploit only affected devices running Windows OS on Advanced RISC Machine (ARM) processors. Both RDP on ARM and Windows OS are commonly used in industrial control systems (ICS) and other operational technology (OT) environments, with industrial enterprises and critical infrastructure being prime targets for this exploit. It has become.
RDP Gateway Vulnerability May Threaten Compliance – CVE-2023-35332
In normal operation, the RDP Gateway Protocol creates a primary secure channel using Transport Control Protocol (TCP) and Transport Layer Security (TLS) version 1.2, widely accepted protocols for secure communication. increase. In addition, a secondary channel is established over User Datagram Protocol (UDP) and implements Datagram Transport Layer Security (DTLS) 1.0.. It’s important to realize that DTLS 1.0 has been deprecated since March 2021 due to well-known vulnerabilities and security risks.
From the researcher’s blog:
“This RDP gateway vulnerability poses both a significant security risk and a significant compliance issue. The use of deprecated or outdated security protocols such as DTLS 1.0 can lead to inadvertent violations of industry standards and regulations. We may be connected.”
The secondary UDP channel is of concern, especially since it uses a protocol with many known issues (DTLS 1.0). The biggest challenge is that carriers may not be aware that they are not complying with this outdated protocol.
Conclusion
The best way to avoid being affected by these vulnerabilities is to update your RDP client and gateway with patches released by Microsoft. But inevitably there will be other RCEs over RDP. So the next critical step is to put robust access controls in place to stay ahead of threat actors. Because of the widespread use of RDP in OT/ICS environments that are nearly impossible to patch, organizations running these systems need security tools that meet their special requirements regarding system availability, operational safety, and so on. It is especially important to find
