5

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 mitigation).

What exactly is the exposure going over public internet? Is there another way to mitigate the exposure other than installing a software patch?

Specifically: my understanding is that CVE-2018-0886 requires a man-in-the-middle setup to initiate an attack. If the client and host are both connected to trusted providers, does it still leave an opportunity for a MITM (intermediate nodes between the providers)?

Also: when initiating an RDP connection, there is often a prompt to accept a certificate (as shown in this question), and it seems to re-appear from time to time between the same pair of client and host. This suggests to me that the RDP host is generating and periodically re-generating a self-signed certificate, which seems to me to be the point at which a MITM can insert itself. Is there any procedure by which the host can generate a long-lived certificate (even if self-signed) which can be transferred to a client (by secure connection) so that the trust relationship is maintained (no prompt to trust a self-signed cert over a questionable connection)? And, in doing this, does it not mitigate the CVE-2018-0886 vulnerability without having to do any patching?

0

Certs aren't going to save you. The only mitigation I'm aware of are the patches.

Allow me to quote from the folks who discovered this CVE: https://blog.preempt.com/how-we-exploited-the-authentication-in-ms-rdp


Exploiting the NTLM relay vulnerability was possible because of the way RDP is implemented. Let's take a look at the process:

  1. Negotiation over capabilities (Usually CredSSP is chosen)
  2. TLS is established
  3. Network Layer Authentication (NLA) is carried out using CredSSP
  4. The client verifies the certificate, displaying warning if needed

Credentials are sent in step 3 listed above, and the cert is verified in step 4. Ouch. This means that a certificate-based enforcement is too late - by the time you realize the cert is wrong, you have already sent credentials.

Not sure what's going on with the certificate re-prompt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.