RDS - Brute-force attack?

[Mark182]

 

FYI image. We have RDS set up on a 2012 R2 server fully patched (Windows updates wise) We've noticed all these audit failures with different usernames (mostly generic). I am guessing we are being Brute-force attacked? We have an SSL cert for this server. The last few days of logs are full of failed log ins. No successful attempts. We also have a security group in AD and if you are not a member of that group wont let you log in. I am guessing we are being probed in other ways. We have had the company who issued the SSL cert run a security audit when we first got the cert and make some amendments they advised.

 

I am guessing maybe we should go down the VPN route and decommission our RDS server or is that overkill?

 

Any advice?

[TechMonkey]

Does your Firewall show a particular IP hitting your RDS? If so it may be worth blocking that IP. Is Barry a valid username or username format?

[bwestlake]

we used to get that all the time, we installed the below program on a trial, and it can block the IPs from the 'attackers'.

rdpguard.com

[Steve21]

Or just use RemoteApps and disable 3389 as the port is open currently I guess?

 

Steve

[Mark182]

Does your Firewall show a particular IP hitting your RDS? If so it may be worth blocking that IP. Is Barry a valid username or username format?

 

We are speaking to our ISP now asking for firewall logs. No Barry is not part of our naming convention.

[soapyfish]

I am not sure that it is a brute force attack for two reasons,

 

1) The time between each attempt varies between 2 and 10 seconds or so.

2) I would expect to see 10's or 100's or requests per second rather than 1 every 2,8 seconds......

 

Not that I am all the familiar with brute forcing RDS to be honest.

[Mark182]

we used to get that all the time, we installed the below program on a trial, and it can block the IPs from the 'attackers'.

rdpguard.com

 

Installing this now and going to give it a bash.

[Katy]

We had this when we had port 3389 open (the full RDS role on any recent OS just doesn't work on our domain for unknown reasons), even discovered someone from Ukraine had managed to log on with a generic junior school account, was quite interesting seeing their attempts to make executables run and bypass the software restriction policy (tons of the same file with slightly different names, all of which were blocked).

 

We ended up sticking a free Sophos UTM in the way so we could just block by source IP country, and eventually got RDS Web to actually work well enough to just disable 3389.

[Mark182]

Yeah, they are having a good go!

[Andy2789]

We have purchased RDPGuard, following a successful brute force attack. Works wonders, we have tailored the settings and almost removed all failed login attempts. We run it on any web facing server, even though we have the firewall set high and filter out a lot of IP's. I am somewhat nervous of a repeat!

[AJWhite1970]

For those that use it, how does rdpguard.com compare against Malwarebytes Business which I'm currently using to protect all my public facing servers? Timing is interesting as my site licence is due for renewal in a few weeks....

[gshaw]

Is that using full-blown RDS with Gateway, Connection Broker etc. or just straight out over 3389?

[Mark182]

Is that using full-blown RDS with Gateway, Connection Broker etc. or just straight out over 3389?

 

Full-Blown with gateway

[Max_Power]

Sorry to bump a very old thread, but does anyone still use RDPGuard to good effect?

[Andy2789]

Yeah - Still using RDPGuard to good effect, it does the job. We have it set to monitor for X3 failed login attempts and blocks the IP, we have also obscured our RDP port to something random and RDPGuard monitors that port. Since doing this, plus some firewall rules, still touch wood... All is well!

[supportman]

This is an old thread and it's 2022, nobody should be using RDP in public really. Especially on the default port of 3389.

 

There are far too many vulnerabilities. It is an open door for ransomware.

[free780]

Should have MFA enforced when using a RDS Gateway.

[Jcx500]

Should have MFA enforced when using a RDS Gateway.

 

This ,

 

Preferably a vpn in these days

[FN-GM]

Yeah - Still using RDPGuard to good effect, it does the job. We have it set to monitor for X3 failed login attempts and blocks the IP, we have also obscured our RDP port to something random and RDPGuard monitors that port. Since doing this, plus some firewall rules, still touch wood... All is well!

 

This wouldn't be any good if the username and password is stolen via phishing as there won't be any failed login attempts.

[Norphy]

This wouldn't be any good if the username and password is stolen via phishing as there won't be any failed login attempts.

 

No, but that doesn’t mean that you shouldn’t try and guard against brute force dictionary attacks.

 

Locking the front door of my house doesn’t do any good if a thief wants to break in via a window - that doesn’t mean that I shouldn’t lock my front door.

[FN-GM]

No, but that doesn’t mean that you shouldn’t try and guard against brute force dictionary attacks.

 

Locking the front door of my house doesn’t do any good if a thief wants to break in via a window - that doesn’t mean that I shouldn’t lock my front door.

 

Completely agree! Im just highlighting for anyone who doesn't know.

[Max_Power]

Aware that it is 2022!

 

We use RDS gateway, on a different port, with MFA enabled, only specific users can access it via groups setup in AD, and after significant brute force attempts (22 attempts a second!) we restricted to UK only IP Addresses on our firewall. Sadly the brute force continued from UK IP Addresses, so we have restricted further to individuals own IP Addresses at their place of residence, however these are changing constantly and its becoming difficult for people to work effectively because if their IP changes over a weekend or during the day they cant access until we update the firewall configs.

So I'm wondering if I could remove the individual IP Restrictions, and use RDP Guard to monitor and block failed brute force attempts from UK IP Addresses, while blocking all other countries on the firewall?