RDP got Pwned

RobertKaucher

http://it.slashdot.org/story/11/08/28/1745211/New-Worm-Morto-Using-RDP-To-Infect-Windows-PCs

I assume most of you are aware of this...

undomiel

I wouldn't necessarily say pwned just that it got the dictionary thrown at it.

RobertKaucher

undomiel wrote: »

I wouldn't necessarily say pwned just that it got the dictionary thrown at it.

Correct, poor choice of words. Typical stuff. Use strong passwords and change the default port.

Zartanasaurus

This explains why a TE member started a thread a week or so ago about outbound RDP connections.

Zartanasaurus

lol@ this list of passwords it tries.

 admin
  password
  server
  test
  user
  pass
  letmein
  1234qwer
  1q2w3e
  1qaz2wsx
  aaa
  abc123
  abcd1234
  admin123
  111
  123
  369
  1111
  12345
  111111
  123123
  123321
  123456
  654321
  666666
  888888
  1234567
  12345678
  123456789
  1234567890

Spaceballs security I guess.

QHalo

1, 2, 3, 4, 5 - YouTube

cyberguypr

Just more proof that the human element is the weakest link. Sad thing is I know a few IT guys who use some of those passwords.

Xantcha

Hey, my password made it to the top of the list.

Everyone

No vulnerability here, and if you're stupid enough to get infected by this, you may just deserve it.

Using a good strong password easily defeats this.

The other thing is... who in their right mind allows RDP connections from the internet? You should have to VPN into the network, which itself should require at least a good username and password, if not certificates, BEFORE you're allowed to use that port to connect to anything.

the_Grinch

The Morto worm threat: Use it to improve your security | Security - InfoWorld

This article I found to sum it up very nicely. I'm not happy that it came out, but this definitely makes you look at security in-depth.