Thursday, March 28, 2024

New RDP Zero-Day Bug Let Hackers to Bypass the Windows Lock Screen on Remote Desktop Sessions

A new Zero-day vulnerability in Microsoft Windows Remote Desktop protocol let attackers hijack the lock screen on remote desktop sessions.

Security researcher Joe Tammariello of Carnegie Mellon University discovered a Zero-day vulnerability in Microsoft Windows Remote Desktop that handles client authentication through NLA.

Network Level Authentication (NLA) is an authentication method used to enhance RD Session Host server security, by authenticating the user before establishing the RD connection and the Windows lock screen appears.

Microsoft recommended enabling NLA to defend against the critical BlueKeep RDP vulnerability(CVE-2019-0708).

The vulnerability affects Windows versions Windows 10 1803 and Windows Server 2019; it can be tracked as CVE-2019-9510 and assigned CVE score of 4.6.

“If a network anomaly triggers a temporary RDP disconnect, upon automatic reconnection the RDP session will be restored to an unlocked state, regardless of how the remote system was left,” explained Will Dormann.

Attack Scenario

1. The user connects to remote Windows 10 1803 or Server 2019 or newer system using RDP.
2. User locks remote desktop session.
3. User leaves the connected system used as an RDP client unattended.

In this case, an attacker could interrupt the network connectivity of the RDP client system, which let hackers gain access to the targeted system without requiring any credentials.

“Two-factor authentication systems that integrate with the Windows login screen, such as Duo Security MFA, are also bypassed using this mechanism.”

Mitigations

  • Users are recommended to lock the local computers instead of the remote computer.
  • RDP sessions should be disconnected rather than locked

Tammariello reported the vulnerability to Microsoft, but the tech giant said: “behavior does not meet the Microsoft Security Servicing Criteria for Windows.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep yourself updated.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles