Remote Code Execution Overview

Why do hackers launch RCE attacks? 

The question of why hackers launch RCE attacks is fairly open-ended, and hackers could have any number of reasons for executing malicious code. The chief motivators tend to be corporate espionage, personally motivated ill will, or financial gain. In regards to financially motivated attacks, research has found that nearly 90% of RCE attacks take place for the sole purpose of cryptomining. 

When a cryptocurrency transaction takes place, a cryptocurrency miner must account for the exchange by adding it to the blockchain. To do this, the miner must solve complex mathematical problems to verify the transaction by cementing its data with a certain block. Many cryptominers compete with one another at this stage, vying for the cryptopayment by trying to beat other miners to a solution to successfully authorize the transaction. 

The mathematical problems that miners are tasked with are so complex that they require a great deal of CPU, more than an average person owns. For this reason, many miners launch RCE attacks with privilege escalation to usurp a network, deny service to users, and monopolize the CPU for mining, thereby increasing their income. 

How to prevent RCE attacks 

RCE attacks are quite complex, and, as recent developments in the field attest, network vulnerabilities are always evolving and creating new possibilities for exploitation. That being said, there are two key preemptive measures MSPs can take to secure their networks against attack and raise the proper red flags when potential threats arise. 

1. Keep both operating systems and third-party software fully updated
   In other words, make sure to implement patches as they become available in response to detected bugs. In addition, it goes without saying that users should employ safe internet browsing behaviors. As the research underscores, hackers don’t abandon old exploits just because patches have developed to thwart them. They can—and do—attack networks using old tricks with the hope that a system is outdated and can still be manipulated. 
2. Invest in quality threat detection software
   This can help with a plethora of tasks that alert MSPs when their customers’ networks could be vulnerable to an expensive attack. Further, it’s wise to Choose products specifically designed with MSPs in mind, as MSP needs vary in scale, scope, and logistics compared to in-house IT departments. 

RCE—an ongoing problem

Despite programmers working to continually improve coding practices to try to plug attacks on vulnerablities, RCE attacks continue to slip through the cracks. Earlier in 2019, Cisco discovered 11 bugs in the Sierra Wireless AirLink ES450 LTE gateway, which could jeopardize any users on the 5G network. Two of these bugs enable RCE and arbitrary command injection, which highlights the pertinence of RCE exploits even in newly developed technology.

Furthermore, even bugs with known patches still plague modern machines, and they will continue to do so as long as outdated systems or unaware users remain a source of potential profit. According to a Fidelis report covering security exploits in the first quarter of 2019, 27% of targeted vulnerabilities were bugs from 2017 and earlier—problems that had existing solutions to draw from but had yet to be implemented. 

For these reasons, it’s clear that MSPs need to continue strict implementation of common preventative measures—and perhaps more importantly, stay aware of the many ways that hackers can deploy RCE to crash devices and compromise entire networks.

Interested in learning more about protecting your customers from remote code execution? Explore our product suite to see how you can monitor for these vulnerabilities.