Port 3389 (RDP): what it is, how it is attacked and how to secure it

Category hub: Ports, protocols and services

In one sentence: Port 3389 is the network door for Windows Remote Desktop, and leaving it open to the internet is one of the most common ways ransomware gangs get in.

What runs on this port

Port 3389 carries RDP, the Remote Desktop Protocol. It lets someone see and control a Windows computer or server from another device as if they were sitting at it. IT teams, MSPs and home workers use it.

Microsoft says the default port for Remote Desktop Services is TCP 3389, and that enabling Remote Desktop opens a port on the PC.

Why attackers look for it

An open RDP port is a login screen to a whole Windows machine. Scans find them fast. Attackers then guess passwords, reuse credentials stolen in earlier breaches or look for unpatched flaws.

In a ransomware advisory the FBI and CISA said RDP compromise was the second most common way into victim networks for the Royal ransomware group, at 13.3 per cent of incidents in the third-party reporting they cited.

How it gets attacked

Password guessing and reused passwords. Windows RDP has no built-in second factor.
No Network Level Authentication (NLA). The logon screen is then reachable before anyone proves who they are.
Unpatched flaws.
Admin accounts used over RDP, which hand over full control when stolen.

The best known flaw is BlueKeep, CVE-2019-0708, in Remote Desktop Services on older Windows versions. CISA said an attacker could send specially crafted packets to a system with RDP enabled, with no user interaction, before authentication. CISA called it wormable, meaning malware using it could spread to other vulnerable machines. Microsoft patched it on 14 May 2019. The NSA advised blocking TCP port 3389 at perimeter firewalls, enabling NLA, disabling Remote Desktop Services if not needed, and patching.

Who it affects and how badly

Sole trader to 10 staff. A router forwarding 3389 to an office PC is a common mistake. Worst case: encrypted files and no backup.
10 to 250 staff. Accountancy and legal practices, construction firms and care providers often keep RDP for remote working or MSP access. Ransomware can stop the practice for days.
250 plus and regulated firms. Healthcare, councils, fintech and insurers face downtime, data loss, regulator reporting and lost clients from one exposed server.

How to check whether yours is exposed

Review firewall and router rules for inbound TCP 3389 or any forwarded alternative port. Microsoft notes rules may be labelled Remote Desktop or Terminal Services.
List every machine with Remote Desktop enabled.
Ask your MSP whether any of their access paths use RDP directly over the internet.
Check that NLA is on, in Remote Desktop settings.

How to secure it

Do not expose port 3389 to the internet. Block it at the perimeter firewall.
Reach remote machines through a VPN or a Remote Desktop Gateway that enforces MFA.
Require Network Level Authentication on every host.
Patch Windows promptly and replace systems that no longer get updates.
Switch Remote Desktop off where it is not needed.
Limit access to named users and keep admin accounts away from RDP.
Set an account lockout policy and alert on repeated failures.
Keep tested offline backups.

Related terms

FAQ

Is it safe to expose RDP to the internet?
No. The NSA and CISA advise blocking TCP 3389 at the perimeter and using other secure access.

What is Network Level Authentication?
A setting where users must authenticate before a remote session is established, according to Microsoft.

What was BlueKeep?
CVE-2019-0708, a wormable pre-authentication flaw in Remote Desktop Services on older Windows, patched by Microsoft on 14 May 2019.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.