Skip to main content
SolarWinds MSP
  • Login
  • Support
  • Partnerships
    • Partnerships Overview
    • Solution Provider Program
    • Technology Alliance Program
    • Distributor Program
SolarWinds MSP
  • Products
    • SolarWinds N-central Automate what you need. Tackle complex networks. Try this remote monitoring and management solution built to help maximize efficiency and scale.
    • SolarWinds RMM Start fast. Grow at your own pace. Try this powerful but simple remote monitoring and management solution.
    • SolarWinds EDR Defend against ransomware, zero-day attacks, and evolving online threats with Endpoint Detection and Response
    • SolarWinds Backup Manage data protection for servers, workstations applications, documents and Microsoft 365 from one SaaS dashboard.
    • Mail Protection & Archiving Protect users from email threats and downtime.
    • Password Management Easily adopt and demonstrate best practice password and documentation management workflows.
      • Passportal Demo
    • PSA & Ticketing Manage ticketing, reporting, and billing to increase helpdesk efficiency.
    • Remote Support Help support customers and their devices with remote support tools designed to be fast and powerful.
  • Solutions

    I'm looking for...

    • Security Solutions
    • Monitoring Solutions
    • Efficiency Solutions
  • Resources
    • Blog
    • Webcasts & Events
    • Ask the N-central Experts
    • Daily Live Demos
    • RMM Foundations Training
    • Upcoming Events
    • Upcoming Webcasts
    • Resource Center
    • COVID-19 Resources
    • Resource Library
      • Case Studies
      • Product Information
      • eBooks
      • White Papers
      • Infographics
    • SolarWinds MSP Free Tools
    • GDPR Resource Center
    • Security Resource Center
    • MSP Institute Webinar Series
    • MSP Advice Project
  • About
    • Contact
    • Customer Success
    • Worldwide sales and support
    • Careers
    • Awards and Recognition
    • Get A Quote
    • Newsroom
      • Press Releases
      • In The News
      • Media Contacts
      • COVID-19 Response
    • Leadership Team
    • Legal
      • Cookie Policy
      • Privacy Notice
      • Software Services Agreement
      • Terms of Use
      • Backup Fair Use Policy
    • Security
      • SolarWinds Security Statement
      • Vendor Data Protection Requirements
    • Support
  • IT Departments
  • Contact Sales
    • Get A Quote
    • General Inquiry
  • TRY NOW
    • SolarWinds RMM
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Passportal
    • SolarWinds N-central
    • SolarWinds Mail Assure
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
  • Request a Quote
  • Try Now
    • SolarWinds RMM
    • SolarWinds N-central
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Mail Assure
    • SolarWinds Passportal
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
Request quote
Filter Blogs
  • Filter by:
  • MSP Business
    • Automation
    • Backup & Disaster Recovery
    • Security-series
    • Best Practices
    • Business
    • Business Growth
    • Business Risk
    • Cloud Computing
    • Customer Service
    • Cybersecurity
    • Cybersecurity Awareness Month
    • Data
    • GDPR
    • Internet of Things
    • IT Support
    • ITSM
    • LOGICcards
    • Machine Learning
    • Mail
    • Managed Services
    • Marketing
    • Mobile
    • Networking
    • Operations
    • Podcast
    • Product
    • PSA
    • Remote Management
    • Research & Trends
    • Risk Intelligence
    • Security
    • Security Vlog
    • Service Desk
    • Services & Support
    • The Head Nerds
    • Tips & Advice
    • Training
Home Blog MSP Business Security Remote Code Execution Overview
Security

Remote Code Execution Overview

By SolarWinds MSP
29 August, 2019

As a managed services provider (MSP), your customers rely on you to keep up to date with potential threats to their data and security. These potential threats require MSPs to consider remote code execution (RCE), a network vulnerability that allows hackers to hijack machines in order to wreak havoc. Once machines are hijacked, hackers can deny service to rightful users, steal or destroy data, and commandeer network resources for their own purposes. 

What is remote code execution? 

Remote code execution can take a variety of forms—but on a basic level, RCE refers to the process by which an agent can exploit a network vulnerability to run arbitrary code on a targeted machine or system. 

While not every instance of remote code execution is due to nefarious activity, the decision to gain access to a network using this backdoor approach generally signals questionable motives. By this logic, most instances of arbitrary code execution constitute a full-blown RCE attack. 

What is an RCE attack? 

In an RCE attack, hackers intentionally exploit a remote code execution vulnerability to run malware. RCE can have disastrous ramifications for an MSP’s network—by prompting the targeted device to perform code execution, a hacker can run their own programming in its place. This programming can then enable them to gain full access, steal data, carry out a full distributed denial of service (DDoS) attack, destroy files and infrastructure, or engage in illegal activity. And as the term remote execution suggests, an RCE cyberattack can take place from any geophysical location. 

To understand how such a glaring breach could occur, it’s important to review common vulnerabilities that can leave certain networks at risk of cyberattack: buffer overflows, deserialization, and type confusion. 

  • Buffer overflow
    A buffer overflow vulnerability refers to memory corruption that can enable malicious RCE. Buffers are sequential memory partitions that can only contain a set amount of data. When programs do not include bounds-checking measures, input can exceed the allocated memory. When a buffer overflows, it overwrites the memory in adjacent buffers. Deploying buffer overflows intentionally can destroy useful data, cause network crashes, or replace memory with arbitrary code that the instruction pointer (manipulated through another vulnerability) later executes. The first buffer overflow attack took place in 1988. The Morris Worm, a now infamous program that was responsible for the attack, caused chaos throughout the U.S. computer system, crashing 6,000 of 60,000 computers on the internet. 
  • Deserialization
    A deserialization vulnerability refers to the translation of data into a live object which can accidentally result in the execution of ordinary code. An object must be serialized—converted into binary—to travel over a network. To utilize this data, a program must deserialize it, converting it back into an object. By manipulating serialized data, unauthorized attackers can produce altered objects that cause the program to execute unintended programming upon deserialization.
  • Type confusion
    Type confusion refers to a vulnerability in which code passes off an object without checking its type. This can lead to a mismatch between the object and the type it ought to be. Attackers can take advantage of this vulnerability by writing into the memory block for an object with one type pointer and reading it with another type pointer, allowing them to execute arbitrary code. 
CTA Image

SolarWinds Remote Monitoring and Management

Get the tools you need to manage, secure, and improve all things IT—all within a single web-based dashboard.

Try It Free Learn More

Why do hackers launch RCE attacks? 

The question of why hackers launch RCE attacks is fairly open-ended, and hackers could have any number of reasons for executing malicious code. The chief motivators tend to be corporate espionage, personally motivated ill will, or financial gain. In regards to financially motivated attacks, research has found that nearly 90% of RCE attacks take place for the sole purpose of cryptomining. 

When a cryptocurrency transaction takes place, a cryptocurrency miner must account for the exchange by adding it to the blockchain. To do this, the miner must solve complex mathematical problems to verify the transaction by cementing its data with a certain block. Many cryptominers compete with one another at this stage, vying for the cryptopayment by trying to beat other miners to a solution to successfully authorize the transaction. 

The mathematical problems that miners are tasked with are so complex that they require a great deal of CPU, more than an average person owns. For this reason, many miners launch RCE attacks with privilege escalation to usurp a network, deny service to users, and monopolize the CPU for mining, thereby increasing their income. 

How to prevent RCE attacks 

RCE attacks are quite complex, and, as recent developments in the field attest, network vulnerabilities are always evolving and creating new possibilities for exploitation. That being said, there are two key preemptive measures MSPs can take to secure their networks against attack and raise the proper red flags when potential threats arise. 

  1. Keep both operating systems and third-party software fully updated
    In other words, make sure to implement patches as they become available in response to detected bugs. In addition, it goes without saying that users should employ safe internet browsing behaviors. As the research underscores, hackers don’t abandon old exploits just because patches have developed to thwart them. They can—and do—attack networks using old tricks with the hope that a system is outdated and can still be manipulated. 
  2. Invest in quality threat detection software
    This can help with a plethora of tasks that alert MSPs when their customers’ networks could be vulnerable to an expensive attack. Further, it’s wise to Choose products specifically designed with MSPs in mind, as MSP needs vary in scale, scope, and logistics compared to in-house IT departments. 

RCE—an ongoing problem

Despite programmers working to continually improve coding practices to try to plug attacks on vulnerablities, RCE attacks continue to slip through the cracks. Earlier in 2019, Cisco discovered 11 bugs in the Sierra Wireless AirLink ES450 LTE gateway, which could jeopardize any users on the 5G network. Two of these bugs enable RCE and arbitrary command injection, which highlights the pertinence of RCE exploits even in newly developed technology.

Furthermore, even bugs with known patches still plague modern machines, and they will continue to do so as long as outdated systems or unaware users remain a source of potential profit. According to a Fidelis report covering security exploits in the first quarter of 2019, 27% of targeted vulnerabilities were bugs from 2017 and earlier—problems that had existing solutions to draw from but had yet to be implemented. 

For these reasons, it’s clear that MSPs need to continue strict implementation of common preventative measures—and perhaps more importantly, stay aware of the many ways that hackers can deploy RCE to crash devices and compromise entire networks.

Interested in learning more about protecting your customers from remote code execution? Explore our product suite to see how you can monitor for these vulnerabilities. 

 

Try Remote Monitoring & Management Today

Get the tools you need to manage, secure, and improve all things IT—all within a single web-based dashboard.

Start your Free Trial

 

 

Additional reading

Buffer Overflow Vulnerabilities and Prevention 
Empower MSP Scottsdale—What the Current State of Cybersecurity Means for MSPs
Types of Penetration Techniques and Methods
You might also like...
Automation

What the Head Nerds Were Up to in 2020

Security

January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be

Security

December 2020 Patch Tuesday—A quiet(er) finish to a busy year in vulnerabilities

Security

Documentation Management API and Why It’s Important for the MSP Business

Security

What Is FIPS-140-2 Standard and When Is It Required?

Security

Malware-as-a-Service: A Crucial Reason Why Security Has Grown More Complex

Want to stay up to date?

Get the latest MSP tips, tricks, and ideas sent to your inbox each week.

Loading form....

If the form does not load in a few seconds, it is probably because your browser is using Tracking Protection. This is either an Ad Blocker plug-in or your browser is in private mode. Please allow tracking on this page to request a subscription.

Note: Firefox users may see a shield icon to the left of the URL in the address bar. Click on this to disable tracking protection for this session/site

Recent Posts
  • What the Head Nerds Were Up to in 2020
  • RMM and PSA Tools: How to Make the Most of Both
  • How to Empower an IT Help Desk Team for Success
  • Six Tips That Will Make Managing Your MSP Company Easier
  • January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be
Categories:
  • Security (230)
  • Tips & Advice (122)
  • Best Practices (94)
  • Managed Services (86)
  • Backup & Disaster Recovery (83)
  • The Head Nerds (75)
  • Business Growth (75)
  • IT Support (42)
  • Business (39)
  • Cybersecurity (37)
  • Automation (37)
  • Operations (34)
  • Mail (33)
  • Remote Management (28)
  • ITSM (25)
  • Data (21)
  • Cloud Computing (21)
  • Networking (21)
  • Marketing (14)
  • Product (11)
  • PSA (11)
  • Service Desk (5)
  • Services & Support (5)
  • Mobile (4)
  • Risk Intelligence (4)
  • Customer Service (3)
  • Internet of Things (3)
  • GDPR (2)
  • Research & Trends (2)
  • Training (2)
  • LOGICcards (1)
  • Business Risk (1)
Show moreless
SolarWinds MSP

Products
  • SolarWinds RMM
  • SolarWinds N-central
  • SolarWinds Backup
  • SolarWinds EDR
  • SolarWinds MSP Manager
  • SolarWinds Mail Assure
  • SolarWinds Risk Intelligence
  • SolarWinds Take Control
  • SolarWinds Passportal
  • All Products Use Cases
Solutions
  • Security Solutions
  • Monitoring Solutions
  • Efficiency Solutions
  • Identify which RMM solution is right for me
  • Drive Efficiency with Automation
  • Manage my MSP Business More Efficiently
  • Manage my IT Department More Efficiently
  • Layered Security
  • Cross-Platform Support
  • Data-Driven Insights
About
  • About Us
  • Careers
  • Newsroom
  • Leadership Team
  • Upcoming Events
  • Subscription Preferences
  • SolarWinds
  • SolarWinds Trust Center
  • COVID-19 Response
Support
  • SolarWinds RMM
  • Solarwinds N-central
  • SolarWinds Backup
  • SolarWinds Mail Assure
  • SolarWinds Take Control
  • SolarWinds MSP Manager
  • Solarwinds Risk Intelligence
  • Solarwinds Threat Monitor
  • SolarWinds Passportal
  • SolarWinds Take Control Downloads
  • Backup & Recovery Downloads
  • Service Status

Footer 2

  • Legal Documents
  • Privacy
  • California Privacy Rights
  • Security Information
  • Sitemap

© SolarWinds MSP Canada ULC and SolarWinds MSP UK Ltd.
All Rights Reserved.