When I try to connect to a remote desktop, a message appears which says something like "Make sure you trust this PC, connecting to untrusted computer might harm your PC". Why would it harm my PC? I can understand that if I am sharing local resources or something like that, but if I am just connecting to a remote desktop how would that harm my computer? isn't it like sandboxed? how will the remote desktop access my PC?
-
Is the remote control bidirectional, maybe?– copyJul 7, 2013 at 1:38
-
3I think you got your terminology wrong. The client is the local computer you're sitting in front of. The server or host is the remote computer you're connecting to.– CodesInChaosJul 7, 2013 at 20:35
-
@CodesInChaos Well, I suck in English and in Computers, what do you expect :D thanks mate– user15119Jul 7, 2013 at 22:29
-
But logically, I am the host, because it is my PC and I am hosting the remote desktop.. this is how I thought of it :(– user15119Jul 7, 2013 at 22:33
-
2No. You're not hosting anything, but you are controlling the remote host. All you do is have a "client software" establish a connection to a remote host (the RDP server), one that you see its desktop and can remotely control through your RDP client on your local computer. This nomenclature is important for exactly this issue we're having here - to avoid confusion and ambiguity. None of us here chose it, but if we're to understand each other, we need to use same terminology, and the industry accepted one is usually the easiest way to avoid such problems. ;)– TildalWaveJul 7, 2013 at 22:44
3 Answers
This is a good question! First a disclaimer that I'm not really qualified to give a complete answer, as I have so far been fairly good at avoiding RDP security issues in untrusted environments. I do use both RDP clients and servers though, but only ever on trusted hosts. That said, I do have a few thoughts why we're seeing such warnings;
It would be fairly reasonable to assume that the majority of security risks would be undertaken by running a RDP server (what Microsoft calls Remote Desktop Services), and there were some quite infamous exploits of it in the past, for example vulnerability to the pass-the-hash or MiTM attacks on non-encrypted connections. We probably still all remember disabling Remote Assistance and removing associated port exceptions in firewalls as one of the first things we did upon installing Windows XP, for example. But risks involved in using a RDP client (or Remote Desktop Connection in Microsoft's terminology) don't seem so self-obvious.
For a more in-depth explanation on terminology used and distinction between a RDP client and a RDP server, please see the update at the end of my answer. But to make things clearer, this is the warning dialog that OP is talking about in the question:
While I haven't been able to find documentation on any recent self-propagating exploits (i.e. viruses, trojans, or worms) taking advantage of Remote Desktop Connections through the use of the updated RDP protocol clients, especially those using TLS, there are still some risks involved with connecting to untrusted RDP servers:
User activity tracking and keylogging: In essence, untrusted RDP server could log all your activity on the server, including websites you browse to, files you download, documents you accessed and were changing, passwords you entered to access remote services through the RDP server, basically keep track of your complete user session.
Infection of client through remote hosted files: Any files you download from the server hosting a RDP session could be tampered with, or infected with malware. You could falsely assume trust in any of these files, thinking since you put them there during your previous RDP session that they weren't tampered with or infected in the meantime, transfer them to your RDP client and open/execute/...
Man-in-the-middle: Similar to user activity tracking, only this time the attacker is active on the RDP server you connect to and is listening in on your RDP client to RDP server connection, RDP server to remote LAN / WAN connections, or possibly both. On top of being able to inspect contents of exchanged network packets, man-in-the-middle is also able to change their contents. The RDP session can be encrypted using TLS, effectively preventing eavesdropping on it, but that isn't necessarily the case with where else you connect to (remote LAN or WAN) using the RDP server.
Social engineering attacks: You could be a victim of a social engineering attack where the attacker gains your trust under false pretense, and cons you into entering a RDP server address that you believe can be trusted in your RDP client while establishing a new session, but the address you entered is actually of attacker's choosing. The attacker could host a RDP server on that address for the sole purpose of recording your login credentials for another, real RDP server you intended to connect to. Thanks to @emtunc for reminding me of this threat!
Honestly, I've probably left out a lot of other possibilities to abuse users trust in the RDP server they're establishing a session with, especially when RDP server can not be trusted but the user assumes this trust anyway, failing to see the potential danger in doing so. But these four example attack vectors should be hopefully enough to demonstrate that there is a clear need for such warnings you're receiving.
Edit to add: Seeing there's some confusion regarding terminology used in my and other answers (which we all use in same way as far as I can tell), I want to clear things up which of the two ends involved in a RDP session is considered a client, and which a server (or a host). These are the excerpts from Wikipedia, to exclude any biased and opinion based explanation:
Wikipedia on Client (computing): A client is a piece of computer hardware or software that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network. The term applies to programs or devices that are part of a client–server model
A client is a computer program that, as part of its operation, relies on sending a request to another computer program (which may or may not be located on another computer). For example, web browsers are clients that connect to web servers and retrieve web pages for display. Email clients retrieve email from mail servers. Online chat uses a variety of clients, which vary depending on the chat protocol being used. Multiplayer video games or online video games may run as a client on each computer. The term "client" may also be applied to computers or devices that run the client software or users that use the client software.
Wikipedia on Server (computing): A server is a system (software and suitable computer hardware) that responds to requests across a computer network to provide, or help to provide, a network service. Servers can be run on a dedicated computer, which is also often referred to as "the server", but many networked computers are capable of hosting servers. In many cases, a computer can provide several services and have several servers running.
Servers operate within a client-server architecture, servers are computer programs running to serve the requests of other programs, the clients. Thus, the server performs some task on behalf of clients. The clients typically connect to the server through the network but may run on the same computer. In the context of Internet Protocol (IP) networking, a server is a program that operates as a socket listener.
To put this into perspective how this terminology applies to a RDP session, I'm also including excerpts from the previously linked RDP server (Remote Desktop Services) and RDP client (Remote Desktop Connection) Wikipedia pages:
Remote Desktop Connection (RDC, also called Remote Desktop, formerly known as Microsoft Terminal Services Client, or mstsc) is the client application for Remote Desktop Services. It allows a user to remotely log in to a networked computer running the terminal services server. RDC presents the desktop interface (or application GUI) of the remote system, as if it were accessed locally.
The server component of Remote Desktop Services is Terminal Server (termdd.sys), which listens on TCP port 3389. When an RDP client connects to this port, it is tagged with a unique SessionID and associated with a freshly spawned console session (Session 0, keyboard, mouse and character mode UI only). The login subsystem (winlogon.exe) and the GDI graphics subsystem is then initiated, which handles the job of authenticating the user and presenting the GUI.
And to put it visually, Remote Desktop Connection client on Windows 8 looks like this before establishing a RDP session:
-
I also recommend reading SearchSecurity's Is RDP secure? Guide to Microsoft RDP security, secure remote access, and if you're interested in securing the server side of a RDP connection also the checklist to go through in this answer to the question Is it secure to connect to a remote Windows Server using Remote Desktop only? on Information Security. Jul 7, 2013 at 2:36
-
2Your answer is ok, but the problem it is not really answering the part about how will it affect the host pc, you are talking about security in general when it comes to RDP.. I want only the part about how will it affect my pc (the host)– user15119Jul 7, 2013 at 16:22
-
@HaLaBi - I was limiting my answer explicitly to how a remote RDP server (the one you connect to using Remote Desktop Connection, and where you get the warning message on as described in your question) might infect a RDP client. I realize that this client-server terminology might not be apparent and cause some confusion, but that's the industry-wide naming convention. What I'm saying is, I've actually described (some of) possible ways of your client PC being affected through the RDP connection, which you say in your comment that I did the other way around. I'm a fair bit confused now :? Jul 7, 2013 at 17:19
-
I was talking about how a HOST would be harmed.. a host in this case is the PC I am using to connect to a remote desktop, I was not talking about how the remote machine will be harmed.– user15119Jul 7, 2013 at 19:35
-
@HaLaBi - Yes, that's what I was talking about also, that's what my answer is all about and I thought I made a clear distinction between the two in my introduction. It's also what all other answers that were posted until now (and comments) here are discussing. Jul 7, 2013 at 19:38
A basic RDP client will, by default, share the clipboard through the RDP session (because it is very convenient). This alone allows the remote server to obtain a copy of everything you select and "copy" on your client, be they text excerpts, files... which is a glaring security issue when the remote host is hostile. Similarly, an hostile server may inject hostile code in the copy&paste mechanism: if you do a copy&paste of a file from a directory on your desktop system to another directory on your desktop system, then the hostile server may intercept the copy and alter the file in transit, thus injecting a virus (if the file is executable in some way).
The theory is that an hostile server cannot do anything bad to the client if all of the following are true:
- There is no shared resource between client and server.
- The server won't get any input (such as key presses and mouse movements) unless the human user explicitly chooses so.
- The RDP client code dutifully validates all data from the server and has no vulnerability such as a buffer overflow in its handling of the protocol messages obtained from the server.
Betting that any of these three conditions is met, let alone that all three are met, would strike me as rather risky...
Even the much simpler situation of doing a text-only SSH connection to an untrusted server is possibly dangerous.
A remote desktop connection allows someone else to fully access a computer. From the other side, the accessed computer could try to send any kind of suspicious and/or malicious data packages using the established "trusted" remote desktop connection.
In malware analysis (for example), one would never connect to an untrusted and potentially infected system without taking the appropriate precautions like using a VM which can be deleted afterwards when it becomes apparent that the infected system you are analyzing is indeed infected and spreads it's nasty stuff using any available network connection. In your case, that would be the remote desktop connection you're about to "trust" when clicking that OK button.
And that's the reason why it reads you need to make sure you are connecting to a trusted computer.
Always keep in mind that a remote desktop connection is - in it's core - nothing else than a bi-directional network connection between two computers. Therefore, all network-related risks are relevant here.
For what it's worth, that message could as well say: "are you sure the other system is not compromised and that the person using the other system has no malicious intents?"
You can't imagine how many non-benign packets I've seen transported over remote desktop connections while I analyzed systems. Those would have instantly infected your system and in most cases you probably wouldn't notice it before harm is done. Trust me, that's the last thing you want to happen...
The message may raise an eyebrow when first reading it, but as soon as you realize what you are about to do (create a "trusted" network connection to a remote system), the warning sure makes sense.
EDIT
In case you missed it: on June 11, 2013, Microsoft had to call out a particularly important patch (MS12-037) which addressed (among other things) a critical flaw in the remote desktop protocol of all Windows operating systems (RDP). If you want to be as secure as possible, make sure you've applied the latest updates and security patches to your system.
-
1RDP is a client-server type protocol built on top of TCP transport layer protocol. While it's technically correct that this connection is bidirectional, the software stack (the RDP protocol) on each side responds to different set of commands they listen to using TCP sockets. This is not much different than how a web server and a web client (a browser) communicate using HTTP protocol on top of TCP. In a nutshell, the client will only respond to a fairly limited subset of commands and can not be equated with what commands the server is capable of interpreting and executing. Jul 7, 2013 at 6:24
-
@TidalWave Thanks, I already know all that (part of my job to know it). Also, it's not as if my reply states that you could be connecting to a botnet's command-and-control server with your pants down. ;) I guess we both agree that remote desktop connections received several security fixes in recent months (and years) that make it "unlikely" for anything bad to actually happen, but OP asked why the message is shown and I think the reason can be found in both our answers. Talking protocols and packets: I hope you know the badness resides in exploited details and not the command-set, don't you?– e-sushiJul 7, 2013 at 6:40
-
1Well yes I guess we both agree in two different styles, but I just wanted to point out the difference in clients and servers in a RDP connection, something that was so far missing in both our answers. This is why this question is interesting, because we're usually all well aware of risks of running the server part, but be rarely hear about the risks or simply connecting a client to such server. Of course, the HTTP client security is much discussed ever since the browsers are capable of executing JavaScript, Flash,... But for RDP clients, it's even difficult to find proper VA documentation. :? Jul 7, 2013 at 6:50
-
@TildalWave Short reminder: back in the days, the “Morto” worm used several well-known vulnerabilities in Microsoft operating systems (specifically the Windows Remote Desktop Protocol) to spread malicious code from host to host over the Internet and local networks. Based on the experience, security professionals change the default RDP port. Also, not so long ago (March 2012) Microsoft’s Patch Tuesday addressed two critical Microsoft Remote Desktop Protocol (RDP) security vulnerabilities that could be exploited by attackers to take control over and crash a Windows system. Trust RDP? Not really.– e-sushiJul 7, 2013 at 6:51
-
1@TildalWave Added an edit containing info about MS12-037, which includes RDP security patch - released June 11, 2013. When combining all information in both our answers, we should have wrapped up an nice little package related to the security question of OP. Now, I'll bookmark that DMZ chat room - got some work on my desk. Nice meeting you - cya around.– e-sushiJul 7, 2013 at 7:32