Remote Desktop Open to the Whole Internet

The office computer, from home

The bookkeeper works from home two afternoons a week, and the owner likes to check quotes in the evening. So someone set up remote desktop, which lets a computer at home take control of one in the office.

To make it work from outside, a setting on the office router sends incoming remote desktop connections straight to that computer. It was set up once, it worked, and nobody has looked at it since.

That setting answers anyone on the internet who finds it, not only the bookkeeper. And plenty of software is looking.

How the door is left open

Remote desktop on Windows listens on a well-known port, a numbered channel that connections arrive on. Forwarding that port on the router puts the office computer's login screen on the open internet.

Automated scanners sweep the internet for that port all day, every day. A newly opened one does not stay unnoticed for long.

Once found, the login screen faces a different kind of software: tools that try usernames and passwords one after another, without ever tiring.

What the guessing tools try

• Common account names such as administrator, admin, office and reception.
• Short passwords, which run out of combinations quickly.
• The company's name with a year or a number added.
• Passwords leaked elsewhere, reused by staff on other accounts.
• Old accounts left active for people who have left.

The fourth is the one an office cannot see coming. A password reused on some other website that was breached ends up on the lists these tools work through, and the office never hears about it.

What happens when one works

A successful login gives the intruder the office computer as though they were sitting at it, with whatever access that user has.

A common next step is ransomware: software that scrambles the files on the computer and on any shared drive within reach, then asks for money to get them back. Some intruders switch off the antivirus first.

Because they came in through a genuine login, nothing about the entry looks like an attack. To the computer, it looks like the bookkeeper.

Why a password alone is not enough

A long, unique password makes guessing far slower, and every remote account should have one. It is still a single lock on a door the whole internet can reach.

Windows can lock an account after repeated failures, but the built-in administrator account is exempt, and a lockout also shuts out the real user.

Moving remote desktop to a different port number delays discovery a little. Scanners check other ports too, so it is not a fix.

A worked example

An interior shutter maker builds custom wooden shutters in a small workshop, with an office at the front where quotes, drawings and the accounting software live on one computer.

Its bookkeeper worked from home through remote desktop, set up years earlier by a technician who forwarded the port on the router. The account password was the company's name and two digits.

One Monday the shared folder of quotes and drawings had been encrypted, with a ransom note on the desktop.

The computer's security log showed weeks of failed logins from addresses around the world, then a successful one late on a Saturday.

The files were restored from an external drive the owner carried home each Friday, so very little was lost.

The forwarding rule was removed that day. The bookkeeper now connects through a secure tunnel on the router that asks for a code from her phone as well as her password, and every account has a new, long password.

Close the open port

Log in to the router, or ask whoever set it up, and look at the port forwarding rules. Any rule sending outside connections to an office computer should have a clear, current reason.

Remote desktop should not be one of them. Remove the rule, then have someone check from outside the office that the port no longer answers.

A tunnel and a second step

The safer route is a secure tunnel, usually called a VPN. The home computer first joins the office network through an encrypted, authenticated link, and only then uses remote desktop inside it.

Many business routers include a VPN server. Add a second login step, a code from a phone, so that a stolen password on its own is not enough.

Remote access services that connect through their own servers are another route, provided two-step login is switched on for every user.

Either way, give each person their own account rather than one shared login, so access can be removed for one person without changing everyone's password.

Check the router itself

While you are in the settings, look at every rule, not just one. Security camera recorders and storage boxes are often opened to the internet the same way, for viewing from a phone.

Switch off UPnP, a feature that lets devices open ports for themselves without asking. Change the router's own admin password, make sure its admin page cannot be reached from outside, and install any firmware update the maker offers.

Check whether anyone got in already

Closing the port stops new attempts. It says nothing about earlier ones, so look back too: the computer's security log records each login, failed or successful, with the time and usually the address.

A successful login at an hour nobody was working, or to an account nobody uses, means someone may already have been inside.

Treat that computer as compromised. Change every password used on it, and have it checked or rebuilt before trusting it again.

The counter-case

An office where nobody works remotely, and whose router has no forwarding rules, has nothing to close. The check takes minutes, and the answer may simply be reassuring.

And a one-person business that rarely needs remote access may be better served by carrying the files it needs on a laptop than by opening any door at all.

Wherever remote access is needed, though, it should come through a tunnel with a second step, never through a port left open to everyone.

This week

1. List every port forwarding rule on the router.
2. Remove the remote desktop rule.
3. Test from outside that the port is closed.
4. Set up a VPN with two-step login.
5. Give every remote user a long, unique password.
6. Disable accounts for people who have left.
7. Switch off UPnP and update the router.

Step two is the one to do today. Everything else improves the setup, but while that rule exists the login screen sits on the open internet and the guessing never stops.

The other common way ransomware reaches an office is described in the document that asks you to enable macros.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.