Businesses of Brighton – Is This You?
RDP is too easy a target
This post highlights a concerning security issue: the exposure of Remote Desktop Protocol (RDP) servers, specifically in Brighton. Using the IoT search engine Shodan, we can visualise these exposed servers on a map, revealing potential vulnerabilities that could be exploited by malicious actors.
What is RDP?
Remote Desktop Protocol (RDP) allows users to remotely access another computer. This is incredibly useful for IT support and remote work, but if not properly secured, it becomes a significant security risk.
The Brighton Exposure Map
This query alone identified over 700 instances of exposed RDP in the Brighton area!
Visualisation of exposed RDP ports across the Brighton coastline.
Why is Exposed RDP a Risk?
Exposed RDP servers are like open doors for hackers. Sophos found that RDP was abused in 90% of cyberattacks in 2023. Attackers can connect and essentially do as they please if no further defences are in place. Ransomware groups, such as BianLian, frequently use RDP as their primary attack vector.
How to Mitigate the Risk
- Close Port 3389: Closing the default RDP port on your firewall is the first step to prevent unauthorised access.
- Multi-Factor Authentication (MFA): Enable MFA for all RDP accounts to add a critical extra layer of security.
- Strong Passwords: Implement unique, complex passwords for every account.
- Restrict Access: Limit RDP access only to authorised users and specific IP addresses.
- Regular Audits: Conduct security audits to identify misconfigured servers.
- Patch Management: Ensure operating systems are updated with the latest security patches.
Conclusion
Hackers do not always have to "hack" their way in; sometimes the doors are wide open. Looking at the data for Brighton, it is clear that many businesses have no idea how exposed they truly are to nefarious activity.
NB: It is possible that undetected mitigations are in place for some of these instances. This blog post is for informational purposes only. SME Cyber Solutions is not responsible for any misuse of this information.
Is Your Office Port Open?
Don't wait for a ransomware group to find your exposed RDP server. We provide Brighton-based businesses with rapid security audits to close these gaps.
Request a Port Scan & Audit