The RDP implementation has a remnant of the image, giving way to hackers.

The RDP implementation has a remnant of the image, allowing hackers to assemble it to steal the data.

RDP or Remote Desktop Protocol is usually a popular way for IT departments based on companies to access the desktop pages of employees to repair their systems or install their software. But this channel also has many vulnerabilities that can be used by hackers, some of which are unpredictable.

According to a report by the website Cyber Security News, the RDP protocol security vulnerability has been detected by a research team from SCYTHE Labs, a cyberanalytics specialist company. The vulnerability exists within the Bitmap file format desktop screen storage system in cached temporary memory, or RDP Bitmap Cache. This method is an alley of desktop screenshots that are relayed to the controller's machine in a similar way to saving website data in parts of web browsers so that users can open the website more quickly. The weakness is at this point because the system stores screenshots. All during the Session of RDP use, including sensitive images attached to the screen. Importantly, the format is stored on the local drive of the control side long after the Session is over. The folder that holds the file is not an Access Restriction folder.

If hackers have access to the image data, hackers will be able to take the raw data into a complete screenshot. Stealing is very easy. Simply use the PowerShell command to compress the file in the folder into a Zip format and then smuggle it out through an ordinary HTTPs protocol. This will cause the data to mix with normal traffic to be caught. After the hacker receives the file, the hacker will use two tools to deal with the file set.

Let's start using tools like BMC Tools to process (Parse) as a sub-block image.

Use the RdpCacheStitcher tool to assemble a file of images that are scattered sub-blocks together, the composition of which is similar to a jigsaw puzzle image concatenation.

Although the image is not fully complete, it is enough to steal the information on the screen. By stealing the data in this way, it is not very new. Many hackers, such as BianLian, Medusa, and Scattered Spider, have long and often used this method to steal the data. In order to steal the cache data, hackers often delete the image cache files on the victim's machine, so if the RDP image cache folder is detected on the empty machine, it is likely that the machine has been hacked.

# Trending # Lemon 8 Howtoo # lemon 8 diary # rdp # freedomhack