Microsoft Warns That Attackers Have Access to BlueKeep Exploit Code

Microsoft indicated recently that "BlueKeep" exploit code for Windows systems is now "widely available" for use by attackers.

The BlueKeep vulnerability (CVE-2019-0708) provides an avenue for remote code execution attacks on older Windows systems that use Microsoft's Remote Desktop Services. It potentially affects users of Windows 7, Windows Server 2008 and Windows Server 2008 R2, as well as the older and unsupported Windows XP and Windows Server 2003 systems. 

Microsoft had issued patches for all of those systems back in May, but it also warned back then that possible worm-like infections could spread worldwide should systems go unpatched. A successful exploit could give attackers "access to all user credentials used on the RDP system," Microsoft's announcement on Thursday explained.

Organizations using Remote Desktop Services on those Windows systems should apply the patch for the vulnerability. They should also protect the system's Remote Desktop Protocol "listener."

"If you have Remote Desktop Protocol (RDP) listening on the internet, we also strongly encourage you to move the RDP listener behind some type of second factor authentication, such as VPN, SSL Tunnel, or RDP gateway," Microsoft advised in the announcement.

Organizations should also enable network-level authentication (NLA), which will block attackers lacking authentication credentials, according to the announcement:

You also want to enable Network Level Authentication (NLA), which is a mitigation to prevent un-authenticated access to the RDP tunnel. NLA forces users to authenticate before connecting to remote systems, which dramatically decreases the chance of success for RDP-based worms. The DART team highly recommends you enable NLA regardless of this patch, as it mitigates a whole slew of other attacks against RDP.

There are "more than 400,000 endpoints" that currently lack "any form of network level authentication," Microsoft's announcement indicated. That finding is based on Windows "telemetry" information that gets sent back to Microsoft.

Back in July, security ratings company BitSight reported that about 805,665 systems were vulnerable to BlueKeep, based on its May 31 data. Using July 23 measurements, BitSight reported this month that about 788,214 systems still remained vulnerable. In other words, about 81 percent of the systems observed back on May 31 still aren't patched.

Telecommunications companies are by far the most exposed organizations to BlueKeep. Other vulnerable sectors include education, technology, government and utilities, according to BitSight.

Security researcher Kevin Beaumont noted in an Aug. 6 Twitter post that security solutions company NCC Group shared a BlueKeep exploit with its consultants. An exploit was publicly demonstrated at the 2019 Security Development Conference in China, he noted in a July Twitter post, and one exploit was even offered up for sale by a U.S. company, he noted.

In addition to patching BlueKeep, Microsoft recently described addressing a so-called "poisoned RDP" vulnerability (CVE-2019-0887) associated with Remote Desktop Services that it patched back in July.

About the Author

Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.


  • Windows Server 20H1 Getting Smaller Containers and Faster PowerShell

    Microsoft is promising to deliver a smaller container size and improved PowerShell performance with its next release of Windows Server.

  • Microsoft Previews Microsoft Teams for Linux

    Microsoft on Tuesday announced a "limited preview" release of Microsoft Teams for certain Linux desktop operating systems.

  • Hyper-V Architecture: Some Clarifications

    Brien answers two thought-provoking reader questions. First, do Hyper-V VMs have direct hardware access? And second, how is it possible to monitor VM resource consumption from the host operating system?

  • Old Stone Wall Graphic

    Microsoft Addressing 36 Vulnerabilities in December Security Patch Release

    Microsoft on Tuesday delivered its December bundle of security patches, which affect Windows, Internet Explorer, Office, Skype for Business, SQL Server and Visual Studio.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.