Check for Unrestricted RDP Access

Risk Level: Very High (act immediately)

Check your Elastic Compute Service (ECS) security groups for inbound rules that allow unrestricted access (i.e. 0.0.0.0/0) on TCP port 3389 and limit the access to trusted IP addresses or IP ranges only in order to implement the Principle of Least Privilege (POLP) and reduce the attack surface. TCP port 3389 is used for secure remote GUI login to Windows VM instances by connecting an RDP client application with an RDP server.

Security

Exposing TCP port 3389 (Remote Desktop Protocol - RDP) to the Internet can increase opportunities for malicious activities such as hacking, Man-In-The-Middle (MITM) attacks and brute-force attacks, therefore it is strongly recommended to configure your Elastic Compute Service (ECS) security groups to limit inbound traffic on TCP port 3389 to known and trusted IP addresses only.

Audit

To determine if your Alibaba Cloud ECS security groups allow unrestricted access on TCP port 3389 (RDP), perform the following operations:

Using Alibaba Cloud Console

Sign in to your Alibaba Cloud account.
Navigate to Elastic Compute Service (ECS) console available at https://ecs.console.aliyun.com/home.
In the left navigation panel, under Network & Security, choose Security Groups.
Select the cloud region where your ECS security groups reside from the top navigation bar.
Click on the ID (link) of the security group that you want to examine, listed in the Security Group ID/Name column.
Select the Security Group Details tab and choose the Inbound tab to access the ingress rules defined for the selected security group.
Check the rules list for any inbound rules with the Protocol Type attribute set to Custom TCP, Port Range set to Destination: 3389/3389 or Destination: 1/65535, and the Authorization Object set to Source 0.0.0.0/0. If one or more rules match the search criteria, there are inbound rules that allow unrestricted access on TCP port 3389, therefore the RDP access to the associated ECS instances is not secured.
Repeat steps no. 5 - 7 for each ECS security group available in the selected cloud region.
Change the cloud region from the top navigation bar and perform the Audit process for other regions.

Using Alibaba Cloud CLI

Run DescribeSecurityGroups command (OSX/Linux/UNIX) to describe the information available for each ECS security group provisioned in the specified cloud region:
```
aliyun ecs DescribeSecurityGroups --RegionId 'eu-west-1'
```

The command output should return the requested details (including the security group ID):

{
	"SecurityGroups": {
		"SecurityGroup": [
			{
				"CreationTime": "2024-02-24T17:42:55Z",
				"Description": "",
				"SecurityGroupId": "sg-abcd1234abcd1234abcd",
				"SecurityGroupName": "sg-abcd1234abcd1234abcd",
				"SecurityGroupType": "normal",
				"ServiceManaged": false,
				"VpcId": "vpc-123456789012345678901"
			},
			{
				"CreationTime": "2024-02-23T17:52:37Z",
				"Description": "",
				"SecurityGroupId": "sg-1234abcd1234abcd1234",
				"SecurityGroupName": "sg-1234abcd1234abcd1234",
				"SecurityGroupType": "normal",
				"ServiceManaged": false,
				"VpcId": "vpc-123456789012345678901"
			}
		]
	},
	"TotalCount": 2,
	"PageNumber": 1,
	"PageSize": 10,
	"RegionId": "eu-west-1",
	"RequestId": "ABCDABCD-1234-ABCD-1234-ABCD1234ABCD"
}

Run DescribeSecurityGroupAttribute command (OSX/Linux/UNIX) using the ID of the ECS security group that you want to examine as the identifier parameter, to describe the inbound rules defined for the selected security group:
```
aliyun ecs DescribeSecurityGroupAttribute 
  --RegionId 'eu-west-1'
  --SecurityGroupId 'sg-abcd1234abcd1234abcd'
  --Direction ingress
```

The command output should return the requested configuration information:

{
	"Description": "System created security group.",
	"InnerAccessPolicy": "Accept",
	"Permissions": {
		"Permission": [
			{
				"CreateTime": "2024-02-23T17:52:37Z",
				"Description": "Allow RDP Access",
				"DestCidrIp": "",
				"DestGroupId": "",
				"DestGroupName": "",
				"DestGroupOwnerAccount": "",
				"DestPrefixListId": "",
				"DestPrefixListName": "",
				"Direction": "ingress",
				"IpProtocol": "TCP",
				"Ipv6DestCidrIp": "",
				"Ipv6SourceCidrIp": "",
				"NicType": "intranet",
				"Policy": "Accept",
				"PortRange": "3389/3389",
				"Priority": 100,
				"SecurityGroupRuleId": "sgr-123456789012345678901",
				"SourceCidrIp": "0.0.0.0/0",
				"SourceGroupId": "",
				"SourceGroupName": "",
				"SourceGroupOwnerAccount": "",
				"SourcePortRange": "",
				"SourcePrefixListId": "",
				"SourcePrefixListName": ""
			},
			{
				"CreateTime": "2024-02-24T16:55:42Z",
				"Description": "Allow full access",
				"DestCidrIp": "",
				"DestGroupId": "",
				"DestGroupName": "",
				"DestGroupOwnerAccount": "",
				"DestPrefixListId": "",
				"DestPrefixListName": "",
				"Direction": "ingress",
				"IpProtocol": "TCP",
				"Ipv6DestCidrIp": "",
				"Ipv6SourceCidrIp": "",
				"NicType": "intranet",
				"Policy": "Accept",
				"PortRange": "1/65535",
				"Priority": 1,
				"SecurityGroupRuleId": "sgr-abcd1234abcd1234abcd1",
				"SourceCidrIp": "0.0.0.0/0",
				"SourceGroupId": "",
				"SourceGroupName": "",
				"SourceGroupOwnerAccount": "",
				"SourcePortRange": "",
				"SourcePrefixListId": "",
				"SourcePrefixListName": ""
			}
		]
	},
	"RegionId": "eu-west-1",
	"RequestId": "ABCDABCD-1234-ABCD-1234-ABCD1234ABCD",
	"SecurityGroupId": "sg-abcd1234abcd1234abcd",
	"SecurityGroupName": "sg-abcd1234abcd1234abcd",
	"VpcId": "vpc-123456789012345678901"
}

Check the inbound rules listed in the "Permission" array for any rules with the "IpProtocol" attribute set to "TCP", "PortRange" set to "3389/3389" or "1/65535", and the "SourceCidrIp" set to "0.0.0.0/0". If one or more rules match the search criteria, there are inbound rules that allow unrestricted access on TCP port 3389, therefore the RDP access to the associated ECS instances is not secured.

Repeat steps no. 3 and 4 for each ECS security group available within the selected cloud region.
Change the cloud region by updating the --RegionId command parameter value and repeat the Audit process for other regions.

Remediation / Resolution

To update the inbound rule configuration for your ECS security groups in order to limit RDP access to trusted entities only (i.e. authorized IP addresses and IP ranges, or other trusted security groups) or to remove the non-compliant rule entirely, perform the following operations:

Using Alibaba Cloud Console

Sign in to your Alibaba Cloud account.
Navigate to Elastic Compute Service (ECS) console available at https://ecs.console.aliyun.com/home.
In the left navigation panel, under Network & Security, choose Security Groups.
Select the cloud region where your ECS security groups reside from the top navigation bar.
Click on the ID (link) of the security group that you want to configure, listed in the Security Group ID/Name.
Select the Security Group Details tab and choose the Inbound tab to access the ingress rules defined for the selected security group.
To change the traffic source for the inbound rule that allows unrestricted RDP access, perform the following actions:
1. Select the rule that you want to modify and choose Modify in the Actions column.
2. Remove 0.0.0.0/0 from Source and provide one of the following authorization objects or a combination of objects: your current IP address, one or more authorized IP addresses and/or IP address ranges, one or more authorized security groups.
3. (Optional) Change the rule description in the Description column.
4. Choose Save to apply the configuration changes.
To remove entirely the inbound rule that allows unrestricted RDP access, perform the following actions:
1. Select the rule that you want to delete and choose Delete in the Actions column.
2. In the Delete Security Group Rule confirmation box choose OK to confirm the removal.
Repeat steps no. 5 - 8 for each ECS security group that you want to configure, available in the selected cloud region.
Change the cloud region from the top navigation bar and perform the Remediation process for other regions.

Using Alibaba Cloud CLI

Run ModifySecurityGroupRule command (OSX/Linux/UNIX) using the ID of the ECS security group that you want to configure as the identifier parameter, to change the traffic source for the inbound rule that allows unrestricted access (i.e. 0.0.0.0/0) on TCP port 3389. For the --SourceCidrIp parameter, you can provide one of the following authorization objects or a combination of objects: your current IP address using CIDR notation (e.g. 10.0.0.5/32), one or more authorized IP addresses and/or IP address ranges using CIDR notation (e.g. 10.0.0.0/16), one or more authorized security groups (e.g. sg-1234abcd1234abcd1234):
```
aliyun ecs ModifySecurityGroupRule
  --region eu-west-1
  --RegionId 'eu-west-1'
  --SecurityGroupId 'sg-abcd1234abcd1234abcd'
  --SecurityGroupRuleId 'sgr-123456789012345678901'
  --Policy accept
  --Priority 100
  --IpProtocol TCP
  --SourceCidrIp '10.0.0.5/32'
  --PortRange '3389/3389'
  --Description 'Limited RDP Access'
```
If successful, the output should return the command request ID:
```
{"RequestId":"ABCDABCD-1234-ABCD-1234-ABCD1234ABCD"}
```
To remove entirely the inbound rule that allows unrestricted RDP access, run RevokeSecurityGroup command (OSX/Linux/UNIX) using the ID of the security group rule that you want to delete as the identifier parameter:
```
aliyun ecs RevokeSecurityGroup 
  --RegionId 'eu-west-1'
  --SecurityGroupId 'sg-abcd1234abcd1234abcd'
  --SecurityGroupRuleId.1 'sgr-123456789012345678901'
```
If successful, the output should return the command request ID:
```
{"RequestId":"1234ABCD-1234-ABCD-1234-ABCD1234ABCD"}
```
Repeat steps no. 1 - 4 for each ECS security group that you want to configure, available in the selected cloud region.
Change the cloud region by updating the --RegionId command parameter value and repeat the Remediation process for other regions.

References

Alibaba Cloud Documentation
Security group rules
Best practices of the security group (part 1)
Best practices for ECS security groups (security group authorization)
Best practices for ECS security groups (security group settings)

Publication date Apr 25, 2024

Audit

Using Alibaba Cloud Console

Using Alibaba Cloud CLI

Remediation / Resolution

Using Alibaba Cloud Console

Using Alibaba Cloud CLI

References

Related AlibabaCloud-ECS rules