Security News > 2021 > January > Threat Actors Can Exploit Windows RDP Servers to Amplify DDoS Attacks
Netscout so far has identified more than 14,000 "Abusable" Windows RDP servers that can be misused by attackers in DDoS attacks-troubling news at a time when this type of attack is on the rise due to the increased volume of people online during the ongoing coronavirus pandemic.
What's more, while initially only advanced attackers with access to "Bespoke DDoS attack infrastructure" used this method of amplification, researchers also observed RDP servers being abused in DDoS-for-hire services by so-called "Booters," they said.
RDP is a part of the Microsoft Windows OS that provides authenticated remote virtual desktop infrastructure access to Windows-based workstations and servers.
To mitigate the use of RDP to amplify DDoS attacks and their related impact, researchers made a number of suggestions to Windows systems administrators.
First and foremost they should deploy Windows RDP servers behind VPN concentrators to prevent them from being abused to amplify DDoS attacks, they said.
"Network operators should perform reconnaissance to identify abusable Windows RDP servers on their networks and/or the networks of their downstream customers," Dobbins and Bjarnason advised.
News URL
https://threatpost.com/threat-actors-can-exploit-windows-rdp-servers-to-amplify-ddos-attacks/163248/
Related news
- Exploit released for new Windows Server "WinReg" NTLM Relay attack (source)
- Microsoft Identifies Storm-0501 as Major Threat in Hybrid Cloud Ransomware Attacks (source)
- Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released (source)
- JPCERT shares Windows Event Log tips to detect ransomware attacks (source)
- Alert: Adobe Commerce and Magento Stores Under Attack from CosmicSting Exploit (source)
- Critical Ivanti RCE flaw with public exploit now used in attacks (source)
- CUPS vulnerabilities could be abused for DDoS attacks (source)
- Cloudflare blocks largest recorded DDoS attack peaking at 3.8Tbps (source)
- Google Adds New Pixel Security Features to Block 2G Exploits and Baseband Attacks (source)
- Recently patched CUPS flaw can be used to amplify DDoS attacks (source)