1

I work with a group of developers that do network level program. To prevent these developers from accidentally causing problems on the corporate network they have been given there own isolated network (different ip range with a shared DMZ).

In the past these developers have maintained 2x computers (one for each network) and when they needed to move files from one network to the other they would use a thumb-drive. However, we recently moved offices and each of the developers was provided with an upgraded computer and told that for access to the corporate network they could remote into an RDP server setup in the DMZ. The problem being that we can no longer use thumb-drives. One of the solutions we came up with was to use the "Local devices and resources" tab under "Show Options" to map local drives to the RDP session, however, IS called foul play.

How is mapping "Local devices and resources" via RDP any more or less secure than our old system of moving files via a thumb-drive?

1

I believe that issue is due to auditing. An RDP session is not the same as a local logon session. Since thumb-drive auditing is very specific, I'd wager that it doesn't kickoff an event due to the nature of RDP.

An example of RDP woes (doesn't trigger account attempt lockout): https://community.spiceworks.com/topic/354021-how-to-limit-rdp-attempts-from-hostiles

If I get more time, I'll try to update with actual facts vs conjecture.

0

With local devices and resources you can allow your local drive to be available on the other network. It will show up as a \tsclient\c for the local C: drive under Network and C on [computername] in the right pane of Explorer. This defeats the purpose of having the disconnected subnets.

I would request an internal FTPS server which can be restricted to a single folder path which should NOT be your common storage area. Filezilla server would work well.

0

It depends on what you map. If you map the C drive, then the client can effectively run arbitrary code on the server because it can run any program psexec style. This is dubbed "RDP inception attack," and allows to client to hop out of the dmz.

If you map a folder, then you have to be careful and never run any program in the folder, because the client can backdoor any file in that folder. It can also drop exploits, like the "stuxnet" lnk exploit.

https://github.com/mdsecactivebreach/RDPInception

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.