Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is vulnerability to man-in-middle attacks, does this attack being eliminated?

share|improve this question
Secure enough for what? All security risk is relative to the attack profiles applicable to your environment. –  Polynomial Jan 22 '13 at 10:03
I just want to know any potential attacks exist? –  user236501 Jan 22 '13 at 10:15
Potential attacks always exist - if you are just asking "has the MITM attack been removed" the answer is best obtained from CVEdetails.com. If you have a specific risk profile, we could answer whether or not RDP 7.0 is secure for that profile... –  Rory Alsop Jan 22 '13 at 11:20
What are those potential attacks? –  user236501 Jan 22 '13 at 11:45
add comment

2 Answers

up vote 0 down vote accepted

With the latest version it is possible to integrate ssl/tls security and two factor authentication mechanisms. If the connection is used to connect to a remote desktop services portal (i.e. RD gateway), network level authentication can be enforced. With a properly planned and implemented infrastructure with a public key infrastructure, it is possible to harden the security. NLA provides more support for hardening the security. It is also possible to use 3 factor authentication methods. As the rule of thumb, each mechanism depends on the current security profile and attack surface. It depends on capabilities, implementations and continuous enhancements. So by just using the latest version, you cannot still ensure the security if it is not up to its standards.

Note: There could still be other issues such as vulnerabilities with certificates and CRL method, pkey export etc(as those do exist).

share|improve this answer
add comment

Recent versions of RDP support SSL/TLS. RDP itself has its own format for transferring data packets; within these packets, recent enough clients and servers can transport the TLS records which will encode a tunnel into which the actual data will be sent (including authentication). This is reasonably secure, insofar as the client and server do not botch the implementation or misuse the certificates (see this answer for some discussion on the subject).

Also, TLS usage is optional and subject to negotiation between client and server; conceivably, an attacker trying a man-in-the-middle attack could alter the first packets so as to simulate a lack of TLS support on both sides, leading to a connection without TLS. It is up to the client implementation to detect this occurrence and abort the connection (or raise a warning and let the user abort).

TLS support was added in RDP 5.2. Free opensource implementations of the RDP protocol usually do not support it.

Another way to TLS-protect a RDP session is the Remote Desktop Gateway (formerly known as Terminal Services Gateway) which encapsulates the whole thing into an SSL/TLS tunnel. This is cumulative with other features of RDP, so you can end up with TLS-in-RDP-in-TLS. The gateway is a specific service available from Windows Server 2008, and only Microsoft's client appears to support it (according to Wikipedia, not even the MacOS port of Microsoft's client can use it).

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.