Analysis of a large brute force attack campaign against Windows Remote Desktop

Re:Analysis of a large brute force attack campaign against W... by ozim on Sunday June 05, 2022 @10:07AM (#31631118)

Well I never ever expose RDP to the internet directly. Allow only office IP or setup some VPN/jumphost via ssh whatever.

I trust SSH much more than RDP to not have RCE/auth bypass bugs. SSH is also much easier to setup key auth or 2FA than in RDP if one like they mentioned in post are more used to setting up Linux boxes.

After reading this blog post - I would not send any logs to their servers.

[ Parent | on HN ]

Re:Analysis of a large brute force attack campaign against W... by CyanLite4 on Sunday June 05, 2022 @11:55AM (#31632103)

Exactly! I at first thought this was a rogue or disgruntled employee who wrote a blog post on the way out. But it appears to be a legit article sanctioned by their company.

They literally opened a server without firewall rules for anyone to connect to their RDP port, and wrote a blog article to brag about it. They also have a Windows agent but they brag about not using Windows in the past 20 years…

[ Parent | on HN ]

Re:Analysis of a large brute force attack campaign against W... by greatquux on Sunday June 05, 2022 @11:51AM (#31632063)

I think though it may be better without 2FA to block attacking IPs no matter what the protocol.

[ Parent | on HN ]