- Joined
- Feb 17, 2021
- Messages
- 3
- Reaction score
- 2
First some Background:
I use microsofts RDP (Remote Desktop) feature regularly to use my PC from remote locations. I was alarmed to discover that from time to time my system was being attacked by repeated attempts to logon. The attacks generally come from IP addresses in Europe ... I am in Australia. In one instance over a period of several hours the Windows event log recorded about 12 thousand failed logon attempts, all from one ip address, using a long list of userids. I have always configured my RDP access to use a non standard port in the belief that random attempts to hack via RDP would have troble finding me so discovering this was fairly alarming.
First Ideas
My first ideas were to use the failed logon events to trigger Windows background Tasks that would create firewall rules to block these rogue attacks. The solution proved complex and in the end I abandoned it as "not possible" using the security package I use. Next was a similar idea using failed logon events to trigger a routine to turn off remote access and also email me that an attack was probably in progress .. this worked OK but meant leaving RDP active until a problem occurred. What I really needed was a generic way to trigger events from a remote location. A way that could be used to control remote access plus other aspects of Windows .. eg shutdowns and restarts etc. etc.
Cloud Control Switches
My next (and so far final) idea was to use what I think of as as "cloud control switches".
With the various cloud services your PC usually includes an "offline" copy of your cloud data.
Whats more changes to data in the cloud are normally synced back to any offline copies on your various devices.
As a Office 365 user I had Microsofts OneDrive I used that for my switches but DropBox or most other cloud services should be OK as alternatives.
A cloud control switch is literally an empty file or folder exists in your cloud space. Its only important characteristic is its name.
For example the name could be ShutdownOFF.
A couple of lines of powershell code that can test for the existence of ShutdownON and if found issues a windows SHUTDOWN
The little powershell script can be scheduled using Windows Task Scheduler to run every few minutes.
To activate a shutdown from anywhere with an internet connection simply access OneDrive and rename ShutdownOFF as ShutdownON
The new name will be synced back to the PC, almost instantly in most cases, and on the next scheduling cycle windows will shut down.
The only other thing in the script I tested was to write a timestamped message to an activity log and to again rename the file to the OFF version to ensure that shutdown did not become a 5 minute repeated event
More Info
If anybody would like some notes for setting up a remote command using a specific example (eg SHUTDOWN or perhaps RESTART) please let me know and I could add to this thread.
Pros Cons
I use microsofts RDP (Remote Desktop) feature regularly to use my PC from remote locations. I was alarmed to discover that from time to time my system was being attacked by repeated attempts to logon. The attacks generally come from IP addresses in Europe ... I am in Australia. In one instance over a period of several hours the Windows event log recorded about 12 thousand failed logon attempts, all from one ip address, using a long list of userids. I have always configured my RDP access to use a non standard port in the belief that random attempts to hack via RDP would have troble finding me so discovering this was fairly alarming.
First Ideas
My first ideas were to use the failed logon events to trigger Windows background Tasks that would create firewall rules to block these rogue attacks. The solution proved complex and in the end I abandoned it as "not possible" using the security package I use. Next was a similar idea using failed logon events to trigger a routine to turn off remote access and also email me that an attack was probably in progress .. this worked OK but meant leaving RDP active until a problem occurred. What I really needed was a generic way to trigger events from a remote location. A way that could be used to control remote access plus other aspects of Windows .. eg shutdowns and restarts etc. etc.
Cloud Control Switches
My next (and so far final) idea was to use what I think of as as "cloud control switches".
With the various cloud services your PC usually includes an "offline" copy of your cloud data.
Whats more changes to data in the cloud are normally synced back to any offline copies on your various devices.
As a Office 365 user I had Microsofts OneDrive I used that for my switches but DropBox or most other cloud services should be OK as alternatives.
A cloud control switch is literally an empty file or folder exists in your cloud space. Its only important characteristic is its name.
For example the name could be ShutdownOFF.
A couple of lines of powershell code that can test for the existence of ShutdownON and if found issues a windows SHUTDOWN
The little powershell script can be scheduled using Windows Task Scheduler to run every few minutes.
To activate a shutdown from anywhere with an internet connection simply access OneDrive and rename ShutdownOFF as ShutdownON
The new name will be synced back to the PC, almost instantly in most cases, and on the next scheduling cycle windows will shut down.
The only other thing in the script I tested was to write a timestamped message to an activity log and to again rename the file to the OFF version to ensure that shutdown did not become a 5 minute repeated event
More Info
If anybody would like some notes for setting up a remote command using a specific example (eg SHUTDOWN or perhaps RESTART) please let me know and I could add to this thread.
Pros Cons
- This approach uses standard features and does not introduce any third party services or protocols
- Security seems sound given that all activity is executed within your own PC securiy and your own cloud space, Naturally if you have shared your cloud space in such a way that others can access and modify the files you create as cloud contrl swithes you would be exposed to them issuing the associated commands.
- The commands that are executed in this way do not happen instantly .. they wait for the next iteration of their script so this may be an issue for some requirements.
- The example above implies one scheduled event and one action action per requirement. If you find multiple uses for this technique you could have one schedule and one script that handles and actions multiple cloud control swithces.
- The repeated time interval scheduling is not very elegant as an IT technique. Ideally I would have liked the scheduling to be triggered by some type of system level event that I am sure is raised when the names changed. However this would need code to test for specific names to be detected for probably every rename event performed in my system. Therefore opted for the looping approach. I am sure the actual scheduling that windows dose is very efficient and the name tests are less than trivial so the overheads of this approach must be hard to measure
