Tag Info

Hot answers tagged

23

There's a couple of differences between using a 3rd party supplier (such as teamviewer) and a direct remote control solution (eg, VNC) Team Viewer has advantages in that it doesn't require ports to be opened on the firewall for inbound connections, which removes a potential point of attack. For example if you have something like VNC listening (and it isn't ...


22

The host machine can impact and alter whatever it wishes in the guest VM. The host can read and write all the memory of the guest, stop and restart it on a per-instruction basis, and, by nature, sees every single data byte which enters or exits the guest. There is nothing which the OS in a guest VM can do to protect itself against an hostile host. Thus, if ...


13

Running Teamviewer isn't very secure: read here To determine who was logged in - look here: C:\Program Files\TeamViewer\VersionX\Connections_incoming.txt C:\Users\XXX\AppData\Roaming\TeamViewer\Connections.txt


11

Very frightening! As a risk, this should be raised to the board - effectively an attacker on the internet only needs to find out that username and password (or an SSH 0-day) and your entire corporate network should be considered compromised. Could the business run without it? Is there anything sensitive on it? This is a bad idea in so many ways: It ...


11

When you say "Welcome" screen with all users listed. Is that so, or is it one named user and then "Other user"? If it is one named user and "Other user" then the named user is actually coming from the RDP client and is not being exposed. Depending on which client you are connecting with, but at least the Win XP client will save last connected user on the ...


11

This is a good question! First a disclaimer that I'm not really qualified to give a complete answer, as I have so far been fairly good at avoiding RDP security issues in untrusted environments. I do use both RDP clients and servers though, but only ever on trusted hosts. That said, I do have a few thoughts why we're seeing such warnings; It would be fairly ...


10

Despite outrageous marketing claims to the contrary, antivirus software is not smart. Antivirus does not recognize "types" of software, as in "mmh... this looks like a tool for RAT". There are strong theoretical reasons why this sort of detection is, in all generality, impossible to achieve, and correspondingly very hard to do in practice. What antivirus ...


9

If users must have SSH to your server, a useful tool to protect your server root is chroot - this will let you give them the apparent functionality of server root, without actually giving them the crown jewels. Alternatively, as you use virtual machines anyway, why not provide them with virtual server instances? Both of these will allow you to run ...


9

If you are using SSL, see this technote for details. In particular, it is important to set up your security layers The three available security layers are: SSL (TLS 1.0) SSL (TLS 1.0) will be used for server authentication and for encrypting all data transferred between the server and the client. Negotiate The most secure ...


9

I just want to add an answer which I think hasn't been touched upon yet. When you connect via teamviewer to another computer, you share your clipboard with that computer (by default). Therefore, everything you copy onto your clipboard is also copied onto the clipboard of the computer you are connected to. By installing a clipboard tracking application such ...


8

It all comes down to the threat model. It depends on the risks and the likelihood of an attack. It depends on what the workstation does. It depends on the clients involved. How is this any different from running SSH on an actual server? If the service account doesn't have permissions to do much then the attack can't get very far. If the service account ...


8

By "open on their router" I assume you mean open to the Internet. I'd advise against this. Remote Desktop Protocol is susceptible to known attacks. Also you say "patched", but even as recently as last week Microsoft issued a security bulletin against RDP: This security update resolves two privately reported vulnerabilities in the Remote Desktop ...


8

From their own FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and OCB, and we ...


7

You can also restrict users to using bash 4 (removing other shells) and record all commands and send copies to a separate log server. Bash: History to Syslog (http://blog.rootshell.be/2009/02/28/bash-history-to-syslog/) This can help you audit user activities and, more importantly, perform forensics when someone does something bad. I would also do the ...


7

If you have no liability for what the users do with the laptop, then what is the benefit to you of monitoring the usage. In the absence of any legitimate benefit, that would leave anyone questioning your motives in doing so - so you would create liability by doing this. There are a lot of other security concerns you should be concerned about - primarily ...


7

Update: The question has since it was originally posted been edited to highlight one difference, namely that RDP v6 over TLS is used. While the answer may still be considered "okay", I must now argue that tunneling TLS over SSH is unnecessary due to a lack of relevant and likely threat-scenarios - assuming correct configuration of TLS certificates etc. In ...


6

Bear in mind that any local apps which are able to connect to localhost will have no barrier to attacking the listening vnc service, so at a minimum still ensure vnc auth remains enabled.


6

If you are connecting to localhost (127.0.0.1) on an ssh forwarded port (the 5901 your forwarded), then yes your connection to the remote host is encrypted.


6

On one hand, it increases the attack surface, on the other it increases manageability. So, it could be a net positive for the risk profile if that's what's being used to manage systems and apply updates. In this particular case, it's just for convenience, and it's on a high risk target. The questions here need to be: Is the risk worth it for the ...


6

Do not forget about tunneling, port forwarding. By default AllowTcpForwarding is yes in sshd_config file and it allows users to forward arbitrary ports. It may cause much more trouble than you can guess. (This is not an ideal stackexchange style answer but I could not find a better answer, it's hard to summarize port forwarding with a few sentences) You ...


6

There may be a fundamental oversimplification in your question and accordingly the answer may be no the system is stronger than the weak host. Peter G. Neumann has pointed out that there is a logical fallacy in thinking that combining two highly secure systems creates a highly secure combined device. To the contrary, if the two systems were not designed ...


6

Take a look at this security analysis of TeamViewer. In short, it's definitely not secure on untrusted networks: http://www.accuvant.com/blog/teamviewer-authentication-protocol-part-1-of-3


6

A basic RDP client will, by default, share the clipboard through the RDP session (because it is very convenient). This alone allows the remote server to obtain a copy of everything you select and "copy" on your client, be they text excerpts, files... which is a glaring security issue when the remote host is hostile. Similarly, an hostile server may inject ...


5

No, there is no additional protection against remote exploits, but you should always set an account password wherever humanly possible, for a whole host of reasons not related to remote code execution bugs. Remote exploits usually result in code execution, and that code would run under the privilege level of the user that was running the exploited service ...


5

Computers are so magic, that they seem disconnected from all social conventions and mundane realities. But that's just a "mirage". Let's translate your question by making just a small change: assume that you want to loan houses instead of laptops. Your question then becomes: I want to be able to enter the houses, to see if the tenant has any issue, or to ...


5

If the the customer's client is security critical do not setup TeamView to connect to it. If breaching the customer's intranet puts the eclient's server at greater risk, then do not user TeamView. A cursory reading shows that TeamView can use UPnP (Universal Plug and Play). There are *29 CVE*s (Common Vulnerabilities and Exposures listed for uPnP! If you ...


5

You shouldn't be worried about it. It looks as if Teredo is a IPv6 tunneling technology. According to this Wikipedia article it allows for IPv6 connectivity by tunneling IPv6 packets through your router encapsulated in IPv4/UDP datagrams (so you can still talk IPv6 even though your router doesn't).


5

I don't know enough about TeamViewer to give you an assessment of its risks or whether it is a good choice for your situation. But I'm going to re-iterate a comment from @Lie Ryan. If you deploy TeamViewer for this purpose, one potential way to reduce the risk of remote attacks is to set up a firewall (on both endpoints) which blocks all access to the ...


5

We're running a TSG with client certificates configured to allow users to connect to their desktops. As long as you allow port 443 and properly configure the resource access policy, it works. There's a tutorial on technet on how to achieve this. However, we're only using it for a small number of people, and we've not run into any of the licensing issues ...


5

In theory, the host can do anything to the guest, so it's no more secure. In practice, I'm not aware of any malware in the wild which would interfere with a guest OS (short of infecting shared filesystems with viruses, or attacking it as though it were a peer), so it is more secure. Schemes like this host-validator on VPN connection are stupid on the ...



Only top voted, non community-wiki answers of a minimum length are eligible