{"id":86996,"date":"2018-10-26T19:13:52","date_gmt":"2018-10-26T13:43:52","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=86996"},"modified":"2018-10-29T18:50:51","modified_gmt":"2018-10-29T13:20:51","slug":"ransomware-attacks-remote-access-rise-secure-system-now","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/ransomware-attacks-remote-access-rise-secure-system-now\/","title":{"rendered":"Ransomware attacks through Remote Access are on rise. Secure your system now!!"},"content":{"rendered":"

Once again ransomware attacks are on the rise and this can leave your systems vulnerable to critical data loss and breach. In fact, the recent outbreak of ransomware allows cyber criminals to easily gain access to your computer through Remote Desktop<\/em> using brute-force technique<\/strong>, which is capable of cracking weak passwords.<\/p>\n

With this post, we wish to help you with essential steps and corrective measures you can take, to protect your computer(s) against ransomware and RDP brute-force attacks.<\/p>\n

However, before we get into the steps to follow, it can be helpful to get a brief understanding about RDP Brute-Force attacks first.<\/p>\n

What is RDP Brute Force Attack? <\/strong><\/p>\n

A RDP brute-force attack is basically a kind of ransomware attack that makes use of Remote Desktop Protocol (RDP). Attackers scan a list of IPs to find the default RDP port 3389<\/strong> that is open for connection. Once the port is discovered, the attacker launches the brute-force attack.<\/p>\n

This is basically a trial & error technique of User ID and password guessing, where the attacker tries a series of commonly used credentials, common word combinations and dictionary words to break through weak passwords. To make things easier for attackers, there are numerous tools readily available that can perform these RDP brute forcing and port scanning with ease.<\/p>\n

Once attackers gain access, all they have to do is to disable your system\u2019s antivirus (even if updated) and infect your system.<\/p>\n

Fortunately, Quick Heal products <\/strong>comes with a security feature that can protect your system against such brute-force attacks.<\/p>\n

We have already released an update to modify rule in Quick Heal\u2019s Firewall that automatically turns off your RDP connections for security reasons and you are sorted. This will discourage hackers from remotely accessing your system.<\/p>\n

With the update already released, there can be 2 possible case scenarios:<\/p>\n

Case #1 I do not wish to use RDP <\/strong><\/p>\n

If you already have Quick product installed on your system, then you have absolutely nothing to worry about. Quick Heal\u2019s Firewall Protection Feature<\/em><\/strong> can effectively block RDP attempt.<\/p>\n

As we have already rolled out an update to disable RDP connection, if your Quick Heal product\u2019s virus database version is 25th<\/sup> October or later, be assured that you are already protected from RDP attacks.<\/p>\n

\u00a0\"\"<\/em><\/p>\n

*In case of any queries, feel free to call us on our toll-free no. 1800-121-7377 and our support engineers would be glad to help you with the issue. You may also visit <\/em>https:\/\/bit.ly\/QHChat<\/em><\/a> to chat with us online. <\/em><\/p>\n

Case #2 I want to continue using RDP <\/strong><\/p>\n

Just in case, it is essential for you to continue using RDP, but at the same time you wish to ensure its security, then you can manually configure the Firewall Protection Feature to configure RDP connection with the help of following steps:<\/p>\n

Open Quick Heal Dashboard => Select Internet and Network => Firewall Protection=> Advanced Settings \u2013 Configure=> Traffic Rules.<\/strong><\/p>\n

\"\"\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\"\"<\/p>\n

 <\/p>\n