Human Involvement Behind Remote Desktop Protocol Brute-Force Attacks
summary
Researchers deploy PiRDP high-interaction honeypots and capture 3.4 million connection attempts over three months to quantify human involvement in RDP brute-force attacks, showing time-of-day and weekend patterns, five attacker clusters, and per-IP behavior that ranges from automated bursts to pause-and-resume human-driven lists. The work surfaces concrete artifacts (NTLM hashes, usernames/passwords), demonstrates targeted credential customization, and evaluates mitigations like VPN exposure reduction and lockout policies.
AI-written summary · about
chapters (12)
- 0:00Human-driven cyber attacks
- 1:30Speaker background
- 3:17RDP explained and trends
- 5:27PiRDP honeypot tool
- 8:19Brute force on RDP systems
- 10:06Attack origins and credentials
- 15:45Attacker strategies
- 17:56Human vs machine attacks
- 23:17Indicators of human involvement
- 26:07Measuring human engagement
- 27:15RDP security mitigation
- 29:40Q&A
related talks
39mI Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
39mFuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
30mCountering Persistent Threat Actors in APAC and Globally
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
49mHe Said, She Said – Poisoned RDP Offense and Defense
15mWhere The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them
29mWhy You Need to Detect More Than PtH