The gangs that commit crimes in cyberspace are abusing Windows Remote Desktop Protocol (RDP) systems to boost unwanted traffic as part of DDoS attacks, said security company Netscout.
Abuse of all RDP servers is not possible, but only on systems where RDP authentication is enabled on UDP port 3389 over the standard TCP port 3389.
Netscout said that attackers can send malformed UDP packets to the UDP ports of RDP servers that will be reflected to the target of the DDoS attack, resulting in unwanted traffic hitting the target's system.
This is what security researchers call a DDoS amplification factor that allows attackers with access to limited resources to launch large-scale DDoS attacks by amplifying unwanted traffic with the help of systems exposed on the internet.
But the bad news doesn't end with the amplification factor. Netscout said that hackers have already learned about this new entity.
Netscout is now asking system administrators running RDP servers that are exposed to the internet to take the systems offline, change them to the appropriate TCP port, or place the RDP servers behind a VPN in order to limit who can interact with the vulnerable systems.
Currently, Netscout stated that it detects more than 33,000 RDP servers that are exposed online and run on UDP port 3389.
Since December 2018, five new DDoS amplification sources have been revealed. These include the Constrained Application Protocol (CoAP), the Web Services Dynamic Discovery (WS-DD) protocol, the Apple Remote Management Service (ARMS), Jenkins servers, and Citrix gateways .
According to the FBI, the first four have been used in actual attacks.
Information source: zdnet.com
