First thing you should know. There are a lot of people who claim to be tech experts and make a living at it who don't know shit. They just know enough to fool you because you don't know shit. I'm just a hobbyist who likes to fix old electronics and try out different OSes and set up servers on my home network and whatnot for fun, and even I know more than these fuckers. They're like a French teacher who only seems like they know French because they're staying one lesson ahead of the student.
A company owned by some friends was using this egghead 50 year old IT guy who just throws meaningless word salad at people when they disagreed with him on something. They needed remote access to some accounting software because the nature of their business required them to work remotely a lot. So egghead sets up a Windows RDP server. They call me one day because among my friends I'm the "computer guy" even though I don't really know all that much. Their server was running slowly, egghead was on holidays and they were wondering if I could get them out of a jam. I looked at the event log and the computer was getting hammered by 60,000 failed login attempts a day. When egghead set it up, he changeed the port, forwarded the port on the router and called it a day. No lockout after a number of failed login attempts. He didn't hide it behind a VPN. He didn't even change the rules in Windows Firewall, he just straight up turned windows firewall off. Most of the login attempts were admin and administrator, but a cursory read through seem to reveal that they did somehow have actual usernames, so there was a chance that someone would eventually get in a be able to obtain all the banking information, employee addresses and social insurance numbers, everything. I turned off port forwarding, flattened the server and reinstalled windows, set up RDP, changed the port, set up new usernames and passwords, set up a ten minute lock after three failed login attempts, set up a VPN on a raspberry pi and forwarded the port on the router to that instead, so now they have to connect to the VPN and input a password to log into the RDP server. The whole time egghead was insisting everything was A-OK because he had a Cisco certificate or some shit.
Second thing you should know. The email accounts provided by ISPs, at least in my area, are a security nightmare. They charge you $6 a month, register a domain for you, and provide you with basic pop/imap/smtp access but none of it in encrypted and the only security on the outgoing mail server is the fact that it's locked to the ISPs network. One of the friends at the same company asked me why he couldn't send messages when he was out of the province. I took a look at his account settings Bell had provided him with and saw mail incoming over a pop connection through port 110(unencrypted). I tried switching to port 995. Didn't work. I called Bell. They told me encryption was not available. They told me they had no international outgoing mail servers. They recommended using their terrible webclient. I showed my friend how anyone with a connection to the Bell network could send an email from his domain by sending an email from
mrt@companydomain.ca through Windows Powershell and he understood the obvious security concerns all this entailed. We ended up transferring the domain to Gandi and just using Gandi's mail service and the actually ended paying nearly the same amount on an annual basis.
So anyway, I'm pretty sure this is how someone got their RDP usernames. They travel a lot and egghead had sent them their login details through email. They probably connected to a fake wifi Network at a big airport or something, though through some miracle it seems like they didn't get the passwords. We'll see if someone end up with a bunch of credit cards in their name.
That was a bit long winded but here's what you should take away:
1) If you don't know a lot about computers, don't trust someone just because they know more than you. They could still be dumb, just not as dumb as you.
2) ISPs provide shitty email service and you shouldn't buy them for your business, get them somewhere else.
3) Never do anything that's unencrypted on a public network. Most websites are encrypted through HTTPs nowadays, but it seems a lot of small businesses are still using unencrypted email. If you're not sure if what you're doing is encrypted, don't connect to a public network.
