Wormable Microsoft RDP flaw appears closer to exploit

Share this article:

The race appears to be on to develop a working exploit for a serious Windows vulnerability patched earlier this week by Microsoft.

The bug in Remote Desktop Protocol (RDP), which allows for the remote connection to other computers, enables an uncredentialed attacker to access and install malicious code on a machine running the tool, if it does not have network-level authentication enabled.

"That's obviously much more serious than a vulnerability which relies upon a user to click on an attachment, or be tricked into running a piece of code," Graham Cluley, senior technology consultant at security firm Sophos, wrote in a blog post on Wednesday.

Microsoft has said it expects a successful exploit to be developed within a month because of "the attractiveness" of the vulnerability to criminals.

Security experts are particularly concerned about the flaw because it affects all Windows versions and could give rise to a worm. Last year, the Morto worm spread, and provided an example of what can happen when there is a weakness in RDP.

So far, however, Microsoft has not seen any public exploit code or active attacks, Yunsun Wee, director of Trustworthy Computing at the software giant, told SCMagazine.com in an email on Thursday. Users are encouraged to apply the patch.

But, according to Russian security firm Positive Technologies, working code already has appeared on a Chinese forum, though the link provided no longer is functional. And according to a report by security blogger Brian Krebs, at least one hacker site is offering a bounty for a successful exploit.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.