Virgin Media Security Alert – Remote Desktop Protocol server notification

[Kumagoro]

So I got this email from Virgin but I'm not really sure if this is just nothing or something. I have had the twice before, last year in January and November 2020. Other than Remote desktop enabled and nothing non standard has been changed on the computers what could it be? Windows wise we have two main computers and two laptops. Considering the lengths of time between emails I am unlikely to be able to work out what is going on in short order. Any ideas?

I found this but I know I haven't done that. Not unless there is a one click option and I have accidentality turned it on at some point.



Your Virgin Media account number: xx - xxxxxxxxx
Our Reference: VMxxxx-RDP-xxxxxxxxxx

Dear Kumagoro,

We’ve been notified of a device on your network that has been configured as a Remote Desktop Protocol (RDP) server, making it accessible from outside your home network.

This email is to make sure you’re aware of this and what it means. Once you’ve finished reading, you only need to take action if you think it’s needed.

What this means


A device on your network has shown signs of running a Remote Desktop Protocol server exposed to the wider internet.



Remote Desktop Protocol is a screen sharing system that allows computers to be accessed remotely from another device on the internet. By default, older versions of the protocol don't make use of encryption, meaning information being passed to and from your device could be accessed by a third party.



If you’re aware of the risks involved in using Remote Desktop Protocol over the internet, or you’ve taken steps to ensure the traffic is encrypted, then you may decide no further action is needed.

However, if you no longer or never did need Remote Desktop Protocol access from outside your home, please visit virginmedia.com/rdp

Detailsof the alert:

IP: (The Modems IP)
Date: 17 March 2023

Further help & support

If you would like further advice or to verify that this is a genuine Virgin Media communication then our community will be happy to help. Just visit virginmedia.com/community, select 'Help forum' and join in the conversation on the Security Matters board.

Kind regards,

The Virgin Media team

[smargh]

Check whether you configured your router to send traffic to your PCs IP - often this is called a "DMZ" setting.

I've seen a VM router misconfigured like this before.

[AGTDenton]

Even though you haven't done the port forwarding it would be worthwhile checking it out.
VM routers are recycled quite a lot, my first one was used and when it failed I got another used router. It would be unlucky to get one without it being flashed.
It could also be caused by UPnP. Modern VM routers might allow you to see the UPnP configured ports.

[Kumagoro]

Cheers for the ideas.

I reckon it isn't a recycled one from memory it had all the cellophane (I did have one before it came stinking of smoke... and I think this was the replacement when I complained).

I will have a check of the router when home then and maybe just stick it back to defaults after to make sure.

[DanceswithUnix]

I would run nmap against your network and see if anything shows as RDP enabled.

[Apex]

If the only devices you have are the 2 desktops and 2 laptops, a quick netstat will show if its one of them; if its still there...

List All Ports and Connections

To list all ports and connections regardless of their state or protocol, use:

netstat -a

List Only Listening Ports

To return a list of only listening ports for all protocols, use:

netstat -l