Is it safe to leave Remote Desktop open to the internet?

What is Remote Desktop?

Remote Desktop lets a person sign in to a Windows computer from somewhere else and use it as if they sat in front of it. It listens on port 3389 by default.

When your router or firewall forwards that port, anyone on the internet can reach the sign-in screen, not only your staff.

Why does it matter?

Exposed services, such as Remote Desktop Protocol (RDP) and content management systems, allow access to your systems. Threat actors can use a variety of tactics, such as exploiting common vulnerabilities and password spraying, to access your devices via these exposed systems and deploy ransomware.

Canada's Cyber Centre lists exposed services such as RDP among the ways ransomware reaches a network. Exposed services, such as Remote Desktop Protocol (RDP) and content management systems, allow access to your systems.

A sign-in screen on the internet can be guessed at all day. A flaw in the service itself is worse: it can let someone in with no password at all.

Has this been used in real attacks?

Microsoft Remote Desktop Services Remote Code Execution Vulnerability 2021-11-03 Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests.

Yes. CISA's catalog of exploited flaws lists BlueKeep, a Remote Desktop flaw that lets an attacker with no account run code over RDP. CISA added it to its catalog on 3 November 2021.

What do I do about it?

Ensure assets on the public Internet do not expose any exploitable services, such as remote desktop protocol. Where these services must be exposed, implement appropriate compensating controls to prevent common forms of abuse and exploitation.

The Cyber Centre's readiness goals say internet-facing assets should not expose services such as Remote Desktop, and that any service which must stay exposed needs extra controls.

1. Turn off port forwarding for 3389 in your router or firewall settings.
2. Give staff a VPN with multi-factor sign-in and reach Remote Desktop only through it.
3. Keep Windows updated on every computer that accepts Remote Desktop.
4. Check the result from outside your office network: port 3389 should not answer.