Windows 10: RDP attack?

szwardzgg · Nov 27, 2020

Hi,

Recently i received an email where someone says that he attacked my computer, made some screenshots and videos and asks $1,035 to not send them to friends.

Email:

I know XXXX is one of your password on day of hack. I use this password for 2 emails but i dont use them too much

Lets get directly to the point.

Not one person has paid me to check about you.

You do not know me and you're probably thinking why you are getting this email?

in fact, i actually placed a malware on the adult vids adult porn website and you know what, you visited this site to experience fun you know what i mean.

When you were viewing videos, your browser started out operating as a RDP having a key logger which provided me with accessibility to your display and web cam.
immediately after that, my malware obtained every one of your contacts from your Messenger, FB, as well as email account.

after that i created a double-screen video. 1st part shows the video you were viewing you have a nice taste omg, and 2nd part displays the recording of your cam, and its you.
Best solution would be to pay me $1035.

We are going to refer to it as a donation. in this situation, i most certainly will without delay remove your video.

My -BTC -address: 1KBVMzZuLQQuNs9uGhv4gnTS8e49ox

Just want to be sure that this is scam and its impossible to access my webcam and screen. This mail is 8 days old btw

:)

Cliff S · Nov 27, 2020

Add RDP capablity to Windows 10 Home

Nice tut Martin*Thumbs

Just a small warning about RDP(not saying anyone shouldn't use it, just protect yourself):

Internet Crime Complaint Center (IC3) | Cyber Actors Increasingly Exploit The Remote Desktop Protocol to Conduct Malicious Activity

Sep 27, 2018

Alert Number
I-092718-PSA
Cyber Actors Increasingly Exploit The Remote Desktop Protocol to Conduct Malicious Activity

BACKGROUND
Remote administration tools, such as Remote Desktop Protocol (RDP), as an attack vector has been on the rise since mid-late 2016 with the rise of dark markets selling RDP Access. Malicious cyber actors have developed methods of identifying and exploiting vulnerable RDP sessions over the Internet to compromise identities, steal login credentials, and ransom other sensitive information. The Federal Bureau of Investigation (FBI) and Department of Homeland Security (DHS) recommend businesses and private citizens review and understand what remote accesses their networks allow and take steps to reduce the likelihood of compromise, which may include disabling RDP if it is not needed.

DEFINITION
Remote Desktop Protocol (RDP) is a proprietary network protocol that allows an individual to control the resources and data of a computer over the Internet. This protocol provides complete control over the desktop of a remote machine by transmitting input such as mouse movements and keystrokes and sending back a graphical user interface. In order for a remote desktop connection to be established, the local and remote machines need to authenticate via a username and password. Cyber actors can infiltrate the connection between the machines and inject malware or ransomware into the remote system. Attacks using the RDP protocol do not require user input, making intrusions difficult to detect.

VULNERABILITIES

Weak passwords – passwords using dictionary words or do not include a mixture of uppercase/lowercase letters, numbers, and special characters – are vulnerable to brute-force attacks and dictionary attacks.

Outdated versions of RDP may use flawed CredSSP, the encryption mechanism, thus enabling a potential man-in-the-middle attack.

Allowing unrestricted access to the default RDP port (TCP 3389).

Allowing unlimited login attempts to a user account.

EXAMPLES OF THREATS
CrySiS Ransomware: CrySIS ransomware primarily targets US businesses through open RDP ports, using both brute-force and dictionary attacks to gain unauthorized remote access. CrySiS then drops its ransomware onto the device and executes it. The threat actors demand payment in Bitcoin in exchange for a decryption key.CryptON Ransomware: CryptON ransomware utilizes brute-force attacks to gain access to RDP sessions, then allows a threat actor to manually execute malicious programs on the compromised machine. Cyber actors typically request Bitcoin in exchange for decryption directions.Samsam Ransomware: Samsam ransomware uses a wide range of exploits, including ones attacking RDP-enabled machines, to perform brute-force attacks. In July 2018, Samsam threat actors used a brute-force attack on RDP login credentials to infiltrate a healthcare company. The ransomware was able to encrypt thousands of machines before detection.Dark Web Exchange: Threat actors buy and sell stolen RDP login credentials on the Dark Web. The value of credentials is determined by the location of the compromised machine, software utilized in the session, and any additional attributes that increase the usability of the stolen resources.

SUGGESTIONS FOR PROTECTION
The use of RDP creates risk. Because RDP has the ability to remotely control a system entirely, usage should be closely regulated, monitored, and controlled. The FBI and DHS recommend implementing the following best practices to protect against RDP-based attacks:

Audit your network for systems using RDP for remote communication. Disable the service if unneeded or install available patches. Users may need to work with their technology vendors to confirm that patches will not affect system processes.

Verify all cloud-based virtual machine instances with a public IP do not have open RDP ports, specifically port 3389, unless there is a valid business reason to do so. Place any system with an open RDP port behind a firewall and require users to use a Virtual Private Network (VPN) to access it through the firewall.

Enable strong passwords and account lockout policies to defend against brute-force attacks.

Apply two-factor authentication, where possible.

Apply system and software updates regularly.

Maintain a good back-up strategy.

Enable logging and ensure logging mechanisms capture RDP logins. Keep logs for a minimum of 90 days and review them regularly to detect intrusion attempts.

When creating cloud-based virtual machines, adhere to the cloud provider's best practices for remote access.

Ensure third parties that require RDP access are required to follow internal policies on remote access.

Minimize network exposure for all control system devices. Where possible, critical devices should not have RDP enabled.

Regulate and limit external to internal RDP connections. When external access to internal resources is required, use secure methods, such as VPNs, recognizing VPNs are only as secure as the connected devices.

Click to expand...

NikolaMiljevski · Nov 27, 2020

Possible RDP attack

Hello,

I got email from someone who said he or she attacked my computer, made some screenshots and videos and asks $1,060 to not send them to friends etc. Here is the email:

I know ***** is one of your password on day of hack..
(by the way he or she is right about the password, which is nevertheless old and practically not used by me very much receantly).

Lets get directly to the point.

Not one person has paid me to check about you.

You do not know me and you're probably thinking why you are getting this email?

in fact, i actually placed a malware on the adult vids (adult porn) website and you know what, you visited this site to experience fun (you know what i mean).

When you were viewing videos, your browser started out operating as a RDP having a key logger which provided me with accessibility to your display and web cam.

immediately after that, my malware obtained every one of your contacts from your Messenger, FB, as well as email account.

after that i created a double-screen video. 1st part shows the video you were viewing (you have a nice taste omg), and 2nd part displays the recording of your cam, and its you.

Best solution would be to pay me $1060.

We are going to refer to it as a donation. in this situation, i most certainly will without delay remove your video.

My -BTC -address:
3BdxDrd75JLW4hg1ANv2aF9BRPBamM

it's a nonnegotiable offer and thus please don't waste mine time & yours by replying to this message.

My questions are:

1. Can II somehow check if the attack really happened?

2. How can I protect myself against such attacks in the future?

3. Is it easy or difficult to trace at least the city from which the email is sent?

I of course won't pay any money to them

I am in Insider program of Windows 10, so probably use the latest version of Windows 10. I use Microsoft Edge and Google Chrome interchangeably, so I don't know which browser did I use when supposed attack happened.

Desiree Yau · Nov 27, 2020

RDP

Hi Nikki,

We can see here that you are having issues using (RDP) Remote Desktop Protocol on your computer. There are several reasons why you are experiencing this concern. To set your expectation, we will be doing some troubleshooting steps to isolate
this problem. Before we proceed, may we know the following:

Any changes made on the computer prior to this concern?

What troubleshooting steps have you tried so far?

Is this the first time that you encountered this problem?

When did you notice about this issue?

Can you send us a screenshot with the error message that you are getting? Note: Please do not include any personal information.

Windows 10: RDP attack?

RDP attack?

RDP attack?

RDP attack?

RDP attack? - Similar Threads - RDP attack

How to skip consent prompt for RDP connections in Windows Server

How to set time limit for disconnected RDP sessions in Windows

Cannot connect to VM (Azure VDI VM) using RDP

i accidentally delete the rdp wrap file dll and when i took it out of trash bin it is an...

i accidentally delete the rdp wrap file dll and when i took it out of trash bin it is an...

RDP Session No Longer Spans Selected Monitors After Windows 24H2 Update

RDP Session No Longer Spans Selected Monitors After Windows 24H2 Update

Are reverse RDP attacks fixed currently?

Possible RDP attack