RDP Security Best Practices Every Admin Ignores Until It's Too Late

Windows ships with a giant backdoor, and Microsoft turns it on by default.

I'm talking about RDP, which I say stands for the Ransomware Deployment Protocol.

This week, Dr. Mike Saylor and Prasanna join me to talk about RDP

and its security best practices.

Why does port 3389 keep showing up in breach reports?

Why do initial access brokers love RDP?

We talk about blocking the port and the service, network-level authentication,

bastion hosts, and the one rule that I'll go to the mattresses for, RDP

does not belong on the internet.

If this is your first time watching or listening to me,

I'm W. Curtis Preston, AKA Mr.

Backup.

I've been obsessing over backup recovery and now cyber recovery for over 30 years.

If that's your bag, I'm your guy.

You're not gonna find anybody that cares about this topic more than me.

Ever since 1993 when I had to tell my boss that there were no backups

of the database that we just lost.

Now I've written five O'Reilly books, a blog, and now a podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap-Up

hi, and welcome to the Backup Wrap Up.

I'm your host, W. Curtis Preston, AKA Mr. Backup, and once again, I

have a guy with me that followed me vicariously this weekend as I

visited roughly a dozen random strange people's houses, Prasanna Malaiyandi.

How's it going, Prasanna?

I'm good, Curtis, and I'm glad that you were not kidnapped or missing a kidney

or anything else like that because I know that you had to go around and pick up

things from people you found on Facebook Marketplace, but those things worry me,

I will say there was at least one house where we're like, "Okay, I'm

not entering this fen-," if I was in Texas, it would be zero houses, right?

but I'm like, "I'm not cracking this fence, but I'm not going into the

yard to knock on a door," right?

I'm like, I'm calling, I'm texting, I'm, But then there was one guy that

came out in his, he was barefoot in his pajamas, and I'm like, "My God." have

some decency, sir," plus his crib was d- But Mike, we, for the, daycare that

I work with, I was, purchasing, 10, infant cribs, two rocking chairs, and

table

Yeah.

that was my weekend.

anyway, speaking of Mike, here we have my co-author of the lovely book right

over my, left shoulder, Dr. Mike Saylor.

How's it going, Mike?

Oh, thank you.

I didn't have any excitement over the weekend, but, hopefully this

coming weekend I'll get to do something that spikes my adrenaline.

Who knows?

Yeah.

just try walking up to 12 random strangers' houses.

That is guaranteed, especially in Texas, to

That's, that's old hat for me.

I d- I used to do that all the time.

Oh, no thank you.

No thank you

I'm gonna, I think I'm gonna, I'm gonna get in the middle of, a fight

between, Black Vulture and my rooster.

See if that'll, that maybe that'll get me charged

up

that I, is a story I wanna hear, but not today.

today we are, we ha- we have been hinting at this episode many weeks.

This is w- a favorite topic that I bring up.

I allude to it quite a bit.

It is my favorite protocol, of all because it is used to deploy ransomware, which is

why it is called the ransomware deployment protocol, otherwise known as RDP.

so

I know you love this topic, so what I'm gonna do is I'm just

gonna mute myself right now.

And for all of the listeners out there, this is just gonna be the Curtis time.

Mike, maybe you might get a word or two in here or there, but, I'm

just gonna mute myself at this point

You're killing me.

This- it's just it's like, don't do this, right?

But so many people do this, right?

it's just there, there's so many initial breaches that are done via RDP, especially

RDP that is accessible via the internet.

I, I joke that it's like, that it's like having a, a kick

me sign on your back, right?

except it's a hack me, it's a hack me

So, before you keep going on, maybe for some people who hopefully everyone's

familiar with RDP, but maybe you should spend 30 seconds talking about what is R-

my intro.

I know, b-

My

you were getting like so intense and you're just about

to go like jumping right in

Like an old married couple

I tell you, yeah, this is why.

I don't know, I don't know why I put up

This is why you keep me around

Yeah, okay.

So the actual name of this product is the Remote Desktop Protocol.

And for those of you that don't know, this is the way that you can

administer, especially, specifically a, a Windows-based… And by that,

I actually don't mean the Windows with a capital W. like a, either a…

what's the… What's… Is it Motif?

Is that the, the Unix version?

Isn't that what it's called?

It's been a while since I've used that term.

But basically a windowing type platform, which very commonly

is, of course, Windows, right?

if it is on, if it is enabled, you can basically run that other system as if

you were sitting there with your mouse.

And, which means that also, so can a hacker.

And over the years, there have been all kinds of vulnerabilities

that have resulted in all kinds of, hacks and, and therefore incidents

and therefore ransoms, et cetera.

And, Mike, do you also have a similar relationship with RDP?

It depends on which, which hat I'm wearing.

so if I'm

Okay

the blue hat, I hate RDP.

If I'm wearing the red hat, love RDP

yeah.

That makes sense.

That makes sense.

Yeah.

I can, I can ma- it makes sense a lot.

But, is

You're al- you're always, you always have a big but, Prasanna.

Go

No, okay.

But, is RDP getting a lot of flack though because ad- administrators, users are

misconfiguring it or not securing it in the proper way, or just taking, the easy

route, and therefore it gets a bad name?

Or does it truly deserve the, nickname ransomware deployment protocol?

I think it's, I think it's a little bit of both, right?

I think it, it got the name because it was so often used as, d- to deploy ransomware.

But, it is, I would say it's a combination, and Mike, I, I am

curious of your opinion here.

it's both like just a protocol and the software underneath it that

runs that protocol have had so many

and therefore, breaches it, it's just a really dangerous protocol.

And then, and people don't know, I don't think they realize

just how dangerous this is.

They leave it unprotected.

They leave it connected to the internet, as a result, they get, they get hacked.

what, w- would you agree with any of that, Mike?

something you… I agree with a lot of that.

and it, RDP has its purpose.

It's a tool.

it's a dollar store hammer instead of, the Home Depot, you know,

professional roofing hammer, right?

so it's still a tool, and you use what you have to use when, sometimes you

don't have budget for more robust tool.

But to your point about, it's not protected, it's connected to the internet,

no one's monitoring when it's being used, all those other things that are

also free and come with your Microsoft environment could help protect the use

of RDP and just traditionally it's not.

And so we're just leaving that dollar store hammer out there on

the table for anybody to pick up.

yeah, there, there's

ways of making it better,

and

traditionally it doesn't

isn't it on by default, Mike?

The serv- yes,

Yeah.

This,

it is.

yeah,

even on the work, even on the

endpoints it's

Just on by default

and but

the endpoint you can't turn, you can't turn all the RDP services off.

You can only turn the, the primary, RDP call service off

But, and everything you said, Mike, makes a lot of sense.

A, there are certain things you can't do, and by the way comes by default,

it's very insecure or could be very insecure if you aren't securing your

firewall to prevent access, right?

This could be externally facing.

But it's, in my mind, that's like similar to being like, I have an

amazing home alarm system, and I'm gonna leave the front door unlocked, right?

Or, like there's certain things that are a little bit like user error, if you will,

or users not using it in the way it was intended to be used or not understanding.

And so I wonder if it's like, yes, there is this tool, yes, they could

have done a better job of securing it or setting the right defaults,

but maybe it's just getting a bad…

And I sound like I'm pro-RDP.

I am not pro-RDP, but I'm just taking the fl- I'm just taking the flip side

and just trying to say, because I think it's useful in some environments, right?

If you can secure it internally, right?

Well, that, that's basically, that's what… It's not that RDP is evil,

it's that it just ha- it, it can really be used for evil, right?

but to take your analogy and maybe just tweak it a little bit, it's as if

every new house comes with a back door that's wide open, and nobody thinks

to maybe lock the back door, right?

like every single builder puts in this door, and then

advertises the door is open.

It's got a big flashing, "I'm not locked," thing above it, and then nobody's like,

"Hey, maybe we should do something." Did you wanna say something, Mike?

It, it's a known protocol, so to your point, if that protocol was available

at, in your house, bad guys just query the whole neighborhood, and

I'll… Very quickly I can find out who's got RDP exposed to the internet.

but Prasanna, made a comment about it, being a, a bad tool.

It's not a bad tool.

and there's a lot of tools out there that are used for evil.

In fact, most tools that guys use to help do their job better are now used for evil.

all the CIS internal tools are, have been cannibalized and turned to the dark side.

it's all about risk mitigation and understanding what the risks are.

So if you're using RDP in your environment, great.

Have you thought about how to protect your environment from the

RDP tool that you think you have to use in- instead of some other tool?

And then cleaning up after yourself, too.

to Curtis's point, it comes dis- installed or turned on by default.

what if your default approach was not to use RDP?

You're using some other remote management tool, but you forgot to turn RDP off.

So there's just, there's just diligence, common sense, and the

analysis of your environment, the risks, and all those things.

So it's no different than taking something out of the box and plugging

it in and thinking everything's fine, knowing that out of the box it's not

fine and doing other things without consideration for reading the manual

and knowing what you've turned on

This manual thing of which you speak

Do, you know, Mike?

about this documentation

Mike, so I totally get for an on-premises environment where you're deploying

Microsoft servers and other things like that, it's on you to secure it.

Do you know if cloud providers, when you are deploying Microsoft Windows

in, say, Amazon AWS EC2 Compute, do they do a better job of helping

secure things by default rather than what you would have on premises,

or they're also in the same boat?

it… You're also in the same… Depending on who your vendor is, you just by default

spin up an Azure environment and put servers out there, absolutely Microsoft

is gonna feed you their Kool-Aid.

they're gonna be using RDP.

It's gonna be configured the way they want it done, unless you tell them differently.

So absolutely, yeah, Microsoft is a Microsoft shop, and they're gonna use all

their stuff, and they think it's great.

it's up to you to mitigate all that or to, to change whatever that might be.

AWS is different.

a lot of AWS, it's either you or a, a, a vendor that you've hired

to help you build your virtualized environment, your cloud environment.

that's kinda on you.

so other environments that aren't Azure are a little different, but in most

cases, unless you dictate how your servers are built, that, especially w-

and it's only Windows, how your Windows servers are built, if you don't, if you

don't spec- if you don't specify, then RDP is gonna be turned on by default.

It's gonna be there whether you use it or not, and if you do use it, it's really

no different than making sure you're using it appropriately and it's secured

appropriately on-premise or in the cloud.

The biggest problem, though, is if you've got it turned on in the

cloud, it's already in the internet,

Yeah

So you've gotta be more cautious about, how am I using RDP?

am I VPN-ing into a cloud environment and then using RDP, or am I using RDP

from my desk through the firewall, out to the internet, through another firewall?

That's even worse almost, 'cause just really,

it, it all depends.

it depends on your environment, depends on your budget, depends

on your skill set, depends on your partners, depends on the environment.

I'm just…

We should, I think we should do a poll on how long

To be a shirt

Mike to say the phrase, "It depends," in each episode.

but, Mike, let's move forward with, so the, e- earlier you were talking

about wandering around the neighborhood and looking for the, in my analogy,

the, the red flashing light, on.

who would do that?

Let's talk about, this, this really important group, the, the IABs

it's, it ranges.

security companies will search for those exposed services in order to identify

opportunities for business development.

there, it's not a… I frown upon that approach, but there are security

companies out there that are the ambulance chasers, if you will.

they're looking for known security flaws, and then they call you and go,

"Hey, just to let you know, you've got this problem. We can help you fix it."

I don't appreciate that, or condone it.

Then there are people, people learning about cyber and this thing.

"Hey, I heard that RDP's bad.

I listened to this, Backup Wrap-Up podcast.

I wanna go check that out." so they're gonna search for

RDP. "All right, I found it.

What do I do with it?" And so there's that.

We call those script kiddies or newbies.

and then you've got the people that really understand what it, the value

of that exposed service, and they're gonna use tools like Shodan, which is a

Nefarious.

it's not, it's a legitimate search engine, but it's 100%

used for bad stuff of the time.

So in Shodan it's so in Google you would say, "What is RDP?" In Shodan you would

say, "Show me every network that has RDP service exposed to the internet around

the entire globe." And it will tell you.

It, so it looks for those types of things.

It doesn't look for articles, it looks for technical stuff,

Right

So Shodan is probably the, the number one if… It's probably the number

one from a volume perspective for searching for stuff like that, and

it gives you pretty verbose results.

It'll tell you the IP address, the type of device that's promoting RDP.

Is it a firewall?

Is it a, a server out on the edge?

Is it, what is it?

country of origin, how long it's been there.

there's any… And that's all on the normal internet.

Then you can take that information into the dark net and see if,

who, who else has attacked this.

are there credentials that I can buy or find?

So it's a process on the recon.

So all that would be considered reconnaissance, and today all that can be

done very quickly, especially with some of the dark net AI tools that are out there.

you can put an attack list and a strategy together in 30 seconds

But Mike,

that… Hang on.

Hang on, Prasanna.

Mike, that was a great answer.

It was not

Now what you

question I asked.

the question I asked was who are initial access brokers?

I thought I'd t- oh, no, I apologize.

thought you were asking if IABs were the ones

okay.

Okay.

Yeah, so

and so my

who, is this en- who is this entity,

much

and how do they figure into this?

Yeah, initial access brokers are the guys that have, or, I'm gonna say guys,

they are the, the group that has…

They've already done the, the, the validation.

so they searched for, and we'll just stick on the RDP theme for now.

they've already identified all the assets with RDP accessible to the internet.

They've already done their homework on are there known or published credentials

for that device, for that RDP service.

and they've packaged that together and they're, they've got that for

sale for someone that wants to utilize it for an attack or whatever reason

But is it safe to say though that without those credentials, just

having RDP exposed out is bad?

It is.

it depends.

No, it is because is it RDP… I- is it truly outbound RDP?

so RDP from your environment to the cloud?

or is it exposed to the internet so you can RDP in home or wherever if there's

a problem or hopefully that's not your remote access mechanism for normal users.

and then the other question is, did you change the password?

Is it default?

Is it easy?

Is it, is it, 1234 and admin?

so yeah, there's any number of ways that we can abuse,

published RDP service

But it also, in addition to, either guessing or obtaining the credentials

to do this, my understanding is that there's also times where there are

vulnerabilities of RDP that where you don't need said credentials.

Is that correct?

Yes, because of the vulnerabilities with RDP aren't specific to authenticating

to RDP versus just capturing RDP traffic

So internal to the network, default, RDP traffic is not encrypted

So I can capture keystrokes.

In fact, I've got a video from years ago where we did a DNS poisoning.

it wasn't DNS, it was a

At least DNS

it was a routing table poisoning.

and so we were able to get a router to sh- to, to send us the keystrokes

that an admin was sending to a server, and we captured all of it, because

our, at the, at, in that case, RDP, the RDP traffic was not encrypted.

so I don't need access to be able to use RDP.

I just need to be on the network.

I just need to be in the middle

to,

to capture-

to take your, that concept, and you said normally on an internal

network it's not encrypted.

If the server is directly on the internet, it's considering the internet the

internal network at that point, right?

So meaning, meaning that the, that your traffic would also not be encrypted

It depends.

So that point-to-point part, so if

Right

talking to the cloud firewall, is that a VPN?

okay.

assume, assuming there's no VPN.

I'm just, I g- I got, a stupid server just sitting flat on the internet, is

what I'm saying, not behind a firewall.

the dumbest server ever, and no firewall, th- it, then it would be unencrypted.

Right

Okay.

Which w- which I think we can all agree would be it, which is the point

of this whole discussion, right?

so I think we can agree, I think all three of us can agree is the never

t- on the internet rule for RDP,

I don't think it's just RDP.

I think it's everything should not be on the internet unless

it needs to be on the internet.

That is true.

I think there are some other services that are perhaps a little more secure

that are s- safer to have on the internet, but, that is a much longer discussion.

Mike, in the book, you talked about something called the survival stack.

if people are gonna… If they need RDP, and by the way, I

still think they don't need it.

They need remote access, right?

If you need remote access and you cannot afford a third-party remote

access solution, then you need, is that, am I on the right track here?

Then we start talking about the network survival stack.

you wanna talk about that?

Sure, and I wanna clear up a misconception about

there are so many enterprise class tools out there now for VPN and

zero trust that, I can think of offhand is, Zscaler, and it's $6 a month.

and that… So that's enterprise.

I'm not talking about the, the people at home that wanna be able to surf the

internet and not, through a VPN and not have, traceability or whatever.

You wanna… If you wanna use some of those other consumer

level that's up to you.

But enterprise stuff, Zscaler is very affordable, and it's very good,

Six, that's $6 a month

So

per, box or per?

per user.

user, okay.

Okay

And that's mid-size.

obviously a lot of companies will scale with you.

if you wanna put 1,000 users on it, maybe it's not $6, maybe it's $4 or

Gotcha.

Okay

it's affordable is what I'm getting at.

And it's, and they're a lot easier to use than, back in the day you

had to have a client installed.

The client had to have a code or a cert or a token that tied it to the server,

and then you had to put credentials in.

Hopefully you had to put credentials in, and that they

were different than your domain.

So then you connect it, and then you have your domain.

or you had to have a, a token with a, a key, a code on it.

Two hours later

things.

Yes.

so long story short, RDP on its own, if you have to use it, you

need to have more controls in place to mitigate the risk of using it.

So you don't wanna RDP directly into your environment.

You want some other method, whether that's VPN or some zero

trust solution, and then use RDP.

So don't let RDP be exposed to the internet.

Just have it running internally, and then u- use some other, more robust,

trusted, configurable, remote access

into the environment,

and Mike, when we say don't let, it be exposed to the internet, the, is

the easiest way to do that is just block that port on the firewall?

Block it at the

Yeah.

Okay.

Both the service and the port, or the protocol and the port

so you talk… Yeah, go ahead

that's important you could block the port and then you're compromised

some other way, because you're not blocking the service, bad guys will

just put it out a different port

Yeah, that makes sense.

But

go ahead

in this case though, Mike, that prevents external access to RDP, correct?

In the sense of your RDP server is no longer visible on the internet.

Is there things you could do in case a, an attacker comes in through some

other, exploit or compromise, gets onto your network to prevent the

lateral movement and exploiting RDP after they're inside your network?

So that, I'm trying not to say depends.

That, that is, it's based on how your architecture's built.

So if you've got a simple flat architecture, you could still

potentially define that rule on your firewall or your core switch.

if you've got a complex environment, then you've gotta, you've gotta replicate

that rule a- across your environment.

You could also have group policy if you're a Windows environment

that prevents it at the endpoint.

You could also have an endpoint anti-malware solution like Huntress,

as an example, that will trigger on the use of those protocols.

You can… This is back to living on the land.

Don't let it be available on that endpoint, right?

Uninstall it, turn it off.

bad guys, if a bad guy's made it to the endpoint and they wanna

pivot, they're not gonna use RDP.

They're gonna… They're probably gonna bring their own remote

management tool like, ServiceNow or Splashtop or something like that

So how does, NLA, network level authentication,

figure into this discussion?

Oh, what… Your architecture will,

It depends.

your architecture will dictate that as well.

So if, again, if you've got a flat environment, you've

got a domain controller.

What, there's a lot of environments don't even have domain controllers.

if you don't have a domain controller, your users are not authenticated to

the network, they're just users that have access to other assets and the

internet, that's probably actually not as risky because the endpoints don't

have access to other stuff, unless you've created shares and things.

But an environment where you've got a domain controller and you're

authenticating to it, domain controller now has to be configured well so that

the authentication of one device can't be cloned or duplicated or stolen.

those Kerberos tickets or, sessions, from one asset to the other.

And you can define in your architecture those routing restrictions that

says, Mike's identity, can only persist on one device at a time.

So group policy, architecture, good architecture design, good domain

controller configuration, firewall rules.

A-again, depends on, architecture.

but all of that is, it's not new.

It just takes time to work through, and if it's done right to begin

with, it's a lot easier to manage

The, yeah, let's move to the sort of the, the things that they should do, right?

We talked about things not to do.

you talked

Don't use Windows.

Oh, I remember, B- by the way, I did… while you two were talking at some

point, I did look, and by the way, I was correct on Motif, but I do date myself.

Apparently, it's not used very much anymore.

That is the Windows manager for

The gnome?

old school Unix and Linux.

and, it's still used… It's very lightweight, and it's still used

in some distributions, but mainly for those that want a retro '90s

aesthetic, according to that.

I've got Openbox, Fluxbox, IceWM, there's a bunch of other ones.

Anyway, just wanna make sure I wasn't crazy.

So one, one of the things that we talked earlier about blocking the, the port

and the service, the port's 3389, but, is something apparently that could

result in a problem if you do that.

but so you wanna talk about that, Mike?

3389 could be used by something else.

And so similar to, other recommendations we've given, you need to do some

analysis in your environment to make sure that there's not some preexisting

rule or service or connection, going out this or any other suspicious port.

you wanna… you don't wanna impact business.

we recommend 3389 'cause that's common for RDP or default RDP, but

your environment could very well be using 3389 for a database connection

or a, a session call or something

It's sad, but, you have that problem, sad on you.

So the next thing I've got on our to-do list here is to, if

possible, I think everything, everything we're saying, right?

No… Everything we're saying is investigate this

in your environment, right?

And that is, if possible, enforce network-level authentication, right?

Because that's gonna support, or that's gonna, require users to prove who they

are before they, start a- an RDP session.

and then prasanna, what's our final recommendation?

Final recommendation is if you are coming from external into an RDP environment

or connecting from one to an RDP environment, use something to secure

that external connection like a VPN such that you have-- you are not exposing

RDP directly to the internet, but you do have that sort of proxy or secure

connection into your network to then pass off into the VP, into the RDP session.

Related to that, I w- I, we didn't have it on our list, but

we discussed it in the book.

that of course would be learning ransomware response and recovery.

I can't believe I didn't mention the name earlier.

We d- we discussed the concept of a bastion host, where you configure it

so that if you're going to use RDP, and anything else that's dangerous,

a- as I make quotes in the air, right?

that you consider a bastion host, where all RDP has to go

via this connection, right?

And I think VPN is one of those ways.

A bastion host would be another way.

And, we seem to have lost Mike.

I don't know

No, he's back

over there?

You're glitching

My all fuzzy.

I'm not sure what's going on

maybe you've been day drinking.

All right,

Wait, I have one more thing to ask or see.

Mike, is there anything from an auditing perspective that you would recommend

for remote desktop connections?

or monitoring

Oh, monitoring for sure.

and there's, there are different ways of doing that too.

There's layers.

There's the endpoint layer, the network layer, the firewall perimeter

layer for all those protocols.

The important part is the governance layer, which is what we, establishing the

policy of what we allow, what we prohibit, and then what are the exceptions.

And then documenting that so when things do come up, we can very quickly

determine if it's allowed or not.

And then your incident response policy would, or procedure would say,

"When these do, when these things happen, here are the people we need

to involve in the conversation so we can determine how to address it."

you heard it here, folks.

Prasanna is pro RDP.

I'm against it, and, Mike is with me.

Well, no, Mike purple hat is with you.

Mike red hat is against you

so

blue says, "No RDP." Red says, "I love RDP." Purple says, "Let's,

let's educate each other on the, the appropriate use of RDP or not."

The Backup Wrap-Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening