Screen Connect Vulnerability & Exploit Feb 2024 [YouTube Release]

That can’t be. Please tell me MSP’s have this server locked down. Patch asap, yes, but it shouldn’t be a “drop your fork and run out the door” emergency. Assuming it is locked down appropriately.

Paul · February 21, 2024, 3:04pm

I believe you do not understand how Screenconnect works, and other MSP remote support tools.

It allows companies to manage / control clients machines remotely over a secure link.

You can not use vpn , client machines will roam between different locations and these all talk back to the hosted screenconnect server, or screenconnect hosted solution

Yes, the firewall will be locked down so that only required ports are open, but in this case the vulnerabilty is in the software

liquidjoe · February 21, 2024, 3:34pm

You are correct, I have not and did not use this back when I was in the industry.

I was thinking about desktop machines sitting on corp LANs. Roaming hosts would complicate things but those can be tunneled too. Basically, lock down to the LAN is my thought. And lock down the control plane to the trusted MSP machines, or a jump box. Is that not what MSP’s do?? Am I missing something obvious?

The LAN exposure from the client devices is still there, but it is a far smaller attack surface than the internet.