Common attacks and weaknesses
- Brute force and credential stuffing against Windows accounts.
- Pre-authentication vulnerabilities such as BlueKeep (CVE-2019-0708) and DejaBlue.
- Stolen RDP access is sold by initial access brokers.
Port 3389: RDP
Microsoft Remote Desktop. One of the most common initial access vectors for ransomware when exposed to the Internet.
3389
How RDP works
Remote accessThe server streams its screen to the client, and the client sends back mouse clicks and keystrokes. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP · UDP
- Exposure risk
- 9/10 critical if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Remote access
Is port 3389 dangerous?
How to secure it
- Never expose RDP directly: use a VPN, an RD Gateway or a zero-trust access proxy.
- Enforce Network Level Authentication and MFA.
- Enable account lockout and monitor event IDs 4625 and 4624 (logon type 10).
IANA registry entries for port 3389
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ms-wbt-server | 3389 | TCP, UDP | MS WBT Server | - | 2022-11-03 |
// source: IANA service name and port number registry
Which program uses port 3389, and is it reachable?
Linux
sudo ss -ltnup 'sport = :3389' # process listening on 3389
sudo lsof -nP -i :3389macOS
sudo lsof -nP -i :3389
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 3389 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 3389 netstat -ano | findstr :3389
From another machine
nmap -p 3389 -sV <host> sudo nmap -sU -p 3389 <host> nc -zv <host> 3389
Block it in the firewall
sudo ufw deny 3389/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 3389" -Direction Inbound -LocalPort 3389 -Protocol TCP -Action Block # Windows
What is port 3389 used for?
Microsoft Remote Desktop. One of the most common initial access vectors for ransomware when exposed to the Internet.
Is port 3389 TCP or UDP?
Port 3389 is registered for TCP and UDP.
Is it safe to open port 3389?
It is rated 9/10 (critical) when exposed to the Internet. Brute force and credential stuffing against Windows accounts. Never expose RDP directly: use a VPN, an RD Gateway or a zero-trust access proxy.
How do I check if port 3389 is open?
On Linux run "ss -ltnup 'sport = :3389'", on macOS "lsof -nP -i :3389", and on Windows "netstat -ano | findstr :3389" to see the local process. From another machine, "nmap -p 3389 <host>" shows whether it is reachable.
Other remote access ports
:22 SSH tcp · udp · sctp · moderate risk :23 Telnet tcp · udp · critical risk :5900 VNC tcp · udp · critical risk :5985 WinRM (HTTP) tcp · udp · high risk :5986 WinRM (HTTPS) tcp · udp · high risk :10000 Webmin tcp · udp · high risk :89 SU/MIT Telnet Gateway tcp · udp :107 Remote Telnet Service tcp · udp