Microsoft Warns of Heightened Threat of 'BlueKeep' Attacks

Older Windows systems using Microsoft's Remote Desktop Services are at acute risk of remote code execution attacks due to the "BlueKeep" vulnerability, Microsoft recently warned.

According to Microsoft, BlueKeep (CVE-2019-0708) exploit code is now "widely available" for use by attackers. The vulnerability potentially affects Windows 7, Windows Server 2008 and Windows Server 2008 R2, as well as the older and unsupported Windows XP and Windows Server 2003 systems. 

Microsoft had issued patches for all of those systems back in May, but it also warned back then that possible worm-like infections could spread worldwide should systems go unpatched. A successful exploit could give attackers "access to all user credentials used on the RDP system," Microsoft's announcement on Thursday explained.

Organizations using Remote Desktop Services on those Windows systems should apply the patch for the vulnerability. They should also protect the system's Remote Desktop Protocol "listener."

"If you have Remote Desktop Protocol (RDP) listening on the internet, we also strongly encourage you to move the RDP listener behind some type of second factor authentication, such as VPN, SSL Tunnel, or RDP gateway," Microsoft advised in the announcement.

Organizations should also enable network-level authentication (NLA), which will block attackers lacking authentication credentials, according to the announcement:

You also want to enable Network Level Authentication (NLA), which is a mitigation to prevent un-authenticated access to the RDP tunnel. NLA forces users to authenticate before connecting to remote systems, which dramatically decreases the chance of success for RDP-based worms. The DART team highly recommends you enable NLA regardless of this patch, as it mitigates a whole slew of other attacks against RDP.

There are "more than 400,000 endpoints" that currently lack "any form of network level authentication," Microsoft's announcement indicated. That finding is based on Windows "telemetry" information that gets sent back to Microsoft.

Back in July, security ratings company BitSight reported that about 805,665 systems were vulnerable to BlueKeep, based on its May 31 data. Using July 23 measurements, BitSight reported this month that about 788,214 systems still remained vulnerable. In other words, about 81 percent of the systems observed back on May 31 still aren't patched.

Telecommunications companies are by far the most exposed organizations to BlueKeep. Other vulnerable sectors include education, technology, government and utilities, according to BitSight.

Security researcher Kevin Beaumont noted in an Aug. 6 Twitter post that security solutions company NCC Group shared a BlueKeep exploit with its consultants. An exploit was publicly demonstrated at the 2019 Security Development Conference in China, he noted in a July Twitter post, and one exploit was even offered up for sale by a U.S. company, he noted.

In addition to patching BlueKeep, Microsoft recently described addressing a so-called "poisoned RDP" vulnerability (CVE-2019-0887) associated with Remote Desktop Services that it patched back in July.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.


  • Phishing Attacks Impersonate Microsoft's Brand the Most

    Security solutions firm Check Point this week gave Microsoft the dubious distinction of being the "most imitated" company used for phishing attacks.

  • Remote Work To Drive Higher Cloud, IT Services Spending in 2021

    Global tech spending has taken a hit in 2020 due to the COVID-19 pandemic, but analysts expect it to rebound next year.

  • 2020 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss. (Now updated with COVID-19-related event changes.)

  • The 2020 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generations of .NET and PowerShell, here's what's on tap from Microsoft this year.