Remote support tools are a favourite way in
CISA added more remote management and support tools to its exploited list this month. If your IT provider uses one, ask about it.
This month CISA added more flaws to its Known Exploited Vulnerabilities list, including a SimpleHelp bug that lets a low-privileged technician account become a server admin, and a maximum-severity bug in Quest KACE systems management. Both are tools IT teams and providers use to reach many computers at once.
That’s exactly why attackers like them. Break into the remote support server and you can reach every machine it manages, with a trusted tool that antivirus ignores.
- Find out which remote support or RMM tools are installed on your computers, including ones your IT provider added.
- Make sure the server is patched, ideally hosted by the vendor or kept off the open internet.
- Require MFA for every technician account.
- Remove old tools that nobody uses. Many networks have three.
- Alert when a new remote access tool appears on a machine.