Tag Info

Hot answers tagged

11

When you say "Welcome" screen with all users listed. Is that so, or is it one named user and then "Other user"? If it is one named user and "Other user" then the named user is actually coming from the RDP client and is not being exposed. Depending on which client you are connecting with, but at least the Win XP client will save last connected user on the ...


8

By "open on their router" I assume you mean open to the Internet. I'd advise against this. Remote Desktop Protocol is susceptible to known attacks. Also you say "patched", but even as recently as last week Microsoft issued a security bulletin against RDP: This security update resolves two privately reported vulnerabilities in the Remote Desktop ...


7

Update: The question has since it was originally posted been edited to highlight one difference, namely that RDP v6 over TLS is used. While the answer may still be considered "okay", I must now argue that tunneling TLS over SSH is unnecessary due to a lack of relevant and likely threat-scenarios - assuming correct configuration of TLS certificates etc. In ...


6

RDP is a complex protocol which requires complex implementations, and thus likely to contain bugs. The initial versions of the protocol did not include much encryption. Ulterior versions are better, and can use either a homemade encryption system (which may or may not use a certificate to embed the server public key), or SSL/TLS (which necessarily uses a ...


5

You should make sure that you are using RDP with the strongest encryption levels enabled. You should also consider using the built-in windows firewall (see how to set this up with advanced settings) or another firewall to only allow connections from your tablet. You can also ensure that your router doesn't allow the RDP port from the Internet. Other options ...


4

There are a few items in addition to what you've written that I would add. Rename your admin account - Yes this might be a pain in the ass (especially if you've got services using the domain admin account) however this is a commonly attempted brute force username. Rename this account to something ambiguous that won't easily be guessed. Don't use common ...


4

As it was already answered before the username is coming from client side of previous RDP connection. So it does not reveal anything from unknown remote desktop system itself Update: but permits to compromise remote systems to which a client had already previously RD-connected by hacking a client computer. RDP sessions are invoked by underlying (in an ...


4

The standard commercial router you mentioned do not allow any incoming connection from outside to the inside of the network. You need to specify allow the incoming connections through port forwarding. If you want to connect to the PC through the same network i.e. both tablet and PC are connection to the same local area network, you don't need to worry about ...


4

RDP has some issues, but these are broadly mitigated by getting the config right. Wicked Clown demonstrated a wonderful privilege escalation attack from restricted user to admin in less than 5 minutes at the recent B Sides London security conference which relied on a common misconfiguration - paper here. TLS can provide a strongly authenticated tunnel - ...


4

You've got two choices: Cut and run Dig deeper Option 1 involves physically unplugging the machine from the network, then treating it as hostile. It's been infected, therefore it's no longer your computer. Grab whatever files you need from it via a live CD, and wipe the drive. Make sure to run an up-to-date AV over the files you copy, just in case ...


3

The old versions of RDP can do some encryption, but it is vulnerable to Man-in-the-Middle attacks for lack of validation of the server public key (older versions used weak encryption as well, or even no encryption at all except for the password sending). Beginning with version 5.2 of the protocol, SSL/TLS can be used (the TLS traffic is encapsulated in the ...


3

Depending on the configuration, there may be the ability to copy and paste to a local document. This could become a compliance issue depending on your industry. Say for example you deal with credit card numbers, social security numbers, etc. Someone could copy that data into an email or text file. It really depends on what kind of data you need to protect. ...


3

It's strict, but I wouldn't say it's overbearing. Let's say there are two ends of the pool, with corporate networks. On the shallow end it's wide open, with no internal firewalls between desktops and servers. You can go to any app, any server, any port, from anywhere. On the deep end, networks are segmented and access controls enforced. Only Finance can ...


3

As SteveS points out below, it is possible that this is a misbehaving Azure server. Azure is a cloud server platform that Microsoft runs. This would also mean that you should really contact the two e-mails on the reverse look-up record. Microsoft would want to know about it whether it is Azure being abused or one of the other problems I originally ...


2

RDP is a protocol with a rather long history, and multiple layers. Recent versions can mix with SSL/TLS in two ways (which can be used concurrently): Since RDP v5.2, the protocol can embed a TLS session (the TLS records are transported as so many messages by the RDP transport layer); the TLS session protects the connection. Since RDP v6.0, the whole ...


2

Microsoft Azure uses a Remote Desktop Gateway kind of situation, so when you initiate a connection to your Azure Server your connection is via HTTPS until you hit the Microsoft Server farm. Once you int the network your connection is "proxied" via the Azure gateway server, this ensures that the only people who would be able to see any sensitive information ...


2

I think the previous answers are correct but should be presented in a different light... let me explain. If you give the user access to view some piece of information, no technological safeguard will prevent them from funneling the data out. For example, I could Citrix into a machine with Cardholder Data and simply write it down on a piece of paper. Please ...


2

I think the main threat is that if you use copy-paste on your local system to copy between two local applications, the remote desktop can spy on the content that has been copy-pasted. (And similarly, if you use copy-paste on the remote desktop to copy between two local applications, a local application can spy on the content that has been copy-pasted.) I ...


2

I agree with Mark, although I have had clients in the past that I've taken over their account and one of the first things that I do is disable the NAT or rule to allow in RDP traffic and either setup some VPN connections to come in on (more secure) OR use a third party solution like logmein or teamviewer. (some people will debate the security on these but ...


2

The first thing you should do is physically disconnect the computer from the network. You might think simply "pulling the plug" would be better from the security point of view and you'd be right. However, by pulling the plug you lose valuable forensic data. You should then notify the person responsible for IT Security of your computer. If that person is you, ...


2

Aside from real people actively using your computer via physical access or remote administration: It is likely that a malicious software, which is able to read the saved password, has sufficient possibilities to read the password from the connection dialog as you type it in. This approach is likely a bit more work for the author of the malicious software ...


2

I do not believe this is a very good thing. There are simple programs on the net which can attack, and exploit vulnerabilities is RDP. I suggest they look into secure VPN instead on directly opening their domain up onto the net. If you want the serious truth: Using TSgrinder, an attacker could try a brute-force attack using customized lists of ...


2

You would have two types of risks: There could be a flaw in the server code. This is a generic situation for every server, but a Remote Desktop server is known to be relatively complex, and thus probably has more exploitable bugs than, say, a SSH server. Microsoft themselves offers an additional product called Remote Desktop Gateway (previously known as ...


2

RDP stands for "Remote Desktop Protocol", so what it provides to people who connect is a full fledged session on the server. By default, this gives these people the same kind of power that they could have by sitting in front of the machine (except that they won't be able to attack the machine "physically"). If you want to prevent users from, e.g., uploading ...


2

There are two risks that immediately occur to me that would be reduced by using a VPN You're avoiding the risk that a single vulnerability provides access to your systems. With straight SSH/RDP a remote code execution vulnerability in the service could allow complete compromise of your environment. With a VPN which then allows access to the service, the ...


1

Unfortunately, this is a known vulnerability. Port 3387 can be used to cause a Denial of Service attacks by running remote exploit code or by Trojans. It is a hot spot. This should be closed by default (Windows). This is a udp or tcp based communication. The protocol is known as backroomnet mainly (used by other services as well). The opened ports can be ...


1

The risk of keeping that port open was demonstrated with the recent MS12-020 security bulletin. The exploit here attacks the service itself which is very serious. RDP has stood up well to attacks so far because once you login you have a new session initialized under that user. A strong password is usually enough. But in this case, the service itself was ...


1

Your XP box should only be able to find out that it is a virtual machine(via hardware detection) and where the RDP connection appears to originate from. I say "appears" because this can be gotten around with technologies like Network Address Translation(NAT). VMWare might have a bug in their code that allows code from within the virtual environment to ...


1

I just don't want to lose the flexibility of connecting from multiple locations. The request for flexibility usually limits security. Especially if you intend to access from multiple locations. However, I am not an expert of RDP and VPN, but you could take client-side certificates into account, too. How secure is the server provided the hosting ...


1

Virtual machines use a virtual network device on the host machine to be able to route traffic into and out of the virtual machine. The host machine will be able to see the network activity of the virtual machine because the host is communicating on behalf of it. the virtual machine on the other hand may or may not be able to see host traffic depending on how ...



Only top voted, non community-wiki answers of a minimum length are eligible