Port 3389: RDP
Analyze default service protocols, historical security vulnerabilities, hardening methods, and firewall rules for port 3389.
1. Port Purpose & Usage
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection.
Common Service Implementations
Microsoft Windows Terminal Services for remote desktop access.
An open-source remote desktop protocol server for Linux environments.
2. Security Risks & Vulnerability Profiles
RDP is one of the most heavily targeted ports on the internet. Automated scripts brute-force RDP connections to gain server entry. Historical flaws in the RDP stack (like BlueKeep) permit remote code execution without authentication.
Historical CVE References
BlueKeep. A critical remote code execution vulnerability in Remote Desktop Services allowed unauthenticated attackers to execute arbitrary code with SYSTEM privileges on vulnerable systems.
DejaBlue. A remote code execution vulnerability in Remote Desktop Services that operates similarly to BlueKeep, affecting newer Windows editions.
3. Hardening & Mitigation Checklist
4. Firewall Command Examples
Use the following system configurations to restrict open port exposure on Linux hosts:
Further Analysis
Remote Administration Ports
Ports often operate in clusters. When analyzing a service on Port 3389, security engineers typically check the status of these related ports.