Nearly 1 Million Computers Still Vulnerable to “Wormable” BlueKeep RDP Flaw

Nearly 1 million Windows systems are still unpatched and have
been found vulnerable to a recently disclosed critical, wormable, remote
code execution vulnerability in the Windows Remote Desktop
Protocol (RDP)—two weeks after Microsoft releases the security
patch.

If exploited, the vulnerability could allow an attacker to
easily cause havoc around the world, potentially much worse than
what WannaCry^[2] and NotPetya^[3] like wormable attacks
did in 2017.

Dubbed BlueKeep and tracked as CVE-2019-0708, the vulnerability
affects Windows 2003, XP, Windows 7, Windows Server 2008 and 2008
R2 editions and could spread automatically on unprotected
systems.

The vulnerability could allow an unauthenticated, remote
attacker to execute arbitrary code and take control of a targeted
computer just by sending specially crafted requests to the device’s
Remote Desktop Service (RDS) via the RDP—without requiring any
interaction from a user.

Describing the BlueKeep vulnerability as being Wormable that could
allow malware to propagate to vulnerable systems just like WannaCry,
Microsoft released a security fix to address the vulnerability with
its May 2019 Patch
Tuesday updates.

However, the latest Internet scan performed by Robert Graham,
head of offensive security research firm Errata Security, revealed^[6] that, unfortunately,
roughly 950,000 publicly accessible machines on the Internet are
vulnerable to the BlueKeep bug.

This clearly means that even after the security patch is out,
not every user and organisation has deployed it to address the
issue, posing a massive risk to individuals and organizations,
including industrial^[7]
and healthcare^[8]
environments.

Graham used “rdpscan^[9],” a quick scanning tool
he built on top of his masscan port scanner that can scan the
entire Internet for systems still vulnerable to the BlueKeep
vulnerability, and found a whole 7 million systems that were
listening on port 3389, of which around 1 million systems are still
vulnerable.

The BlueKeep vulnerability has so much potential to wreak havoc
worldwide that it forced Microsoft to release patches for not only
the supported Windows versions but also Windows XP, Windows Vista
and Windows Server 2003, which no longer receive mainstream support
from the company but are still widely used.
Not just researchers, malicious hackers and cybercriminals have
also started scanning the Internet for vulnerable Windows systems
to target them with malware, GreyNoise Intelligence said.

However, fortunately, so far no security researcher has yet
publicly published any proof-of-concept exploit code for BlueKeep,
though a few of them have confirmed to have successfully developed
a working exploit.

Are you still waiting for me to tell you what you should do
next? Go and fix the goddamn vulnerability if you are using one of
them.

If fixing the flaw in your organisation is not possible anytime
sooner, then you can take these mitigations:

• Disable RDP services, if not required.
• Block port 3389 using a firewall or make it accessible only
  over a private VPN.
• Enable Network Level Authentication (NLA) – this is partial
  mitigation to prevent any unauthenticated attacker from exploiting
  this Wormable flaw.

^[1][4][5]