1

The question is mainly about the default windows implementation of rdp, but could also apply to xrdp. Enabling rdp is an option in the windows settings (remote desktop).

I would like to use rdp in a secured local network, to connect computers inside this network to each other, but I was wondering if there are some risks (unauthorized access/intrusion) by leaving all computers of a network with rdp enabled, which doesn't sound very reassuring.

I have a hardware firewall between this local network and the outside, no redirections have been made for port 3389, and I never change default ports. Some computers in the network are connected remotely through properly configured VPNs going through the firewall.

I have the same question for a network which doesn't have a hardware firewall but a regular internet router. (home isp gateway) As far as I know there is no redirection either.

Improve this question
2
  • 1
    With regard to your last question - see security.stackexchange.com/questions/8772/… for some interesting reading on whether or not the NAT function on a typical SOHO router can be relied on to provide firewall functionality.
    – mti2935
    Dec 8, 2022 at 18:38
  • @mti2935 as far as I know isp router/gateways usually have (mine at least) firewall capabilities as proven by options that allows to "block" all incoming traffic. which is the case for me. the hardware firewall blocks most of all incoming traffic and allows some. (it needs to allow vpns, sip, and maybe a few others unrelated to rdp)
    – user9203881
    Dec 8, 2022 at 19:37

1 Answer 1

Reset to default
1

Obviously, the risk of having RDP enabled is greater than the risk of not having it.

Risks of having RDP enabled in the local network

By enabling RDP, you are allowing connections between computers, providing an easy way for an attacker to perform lateral movements inside your company. Someone that compromised one computer and was able to escalate privileges locally could easily compromise all the computers inside this network.

Moreover, vulnerabilities in RDP (like BlueKeep and friends) may make the computers vulnerable even without having valid credentials.

Risks on RDP being accessed from the outside

Here you are relying on (a) the hardware firewall (b) computers connected through VPN or (c) a regular internet router in order to avoid RDP access from outside.

If the computers are inside of one building and never leave it, your firewall could ensure that no remote connection goes into an internal 3389 port. But if it's ever outside the premises (e.g. telecommuting, business trip…) it's no longer easy.

  • USB 5G dongles may happily provide a public IP address to the computer, reachable from the internet.
  • Though there is a VPN connection, the computer may nevertheless be accepting RDP connections directed to the public IP
  • Even when that's not the case, the computer would be vulnerable to remote connections before the VPN is started or after its shutdown
  • Even if the computer which VPN in is used behind a home router which fences it from the internet (through firewall capabilities or NAT), other computers in that home network may be infected / compromised.

You may think your computers won't actually be exposed on the internet that way, but I have seen many computers that were accessible via RDP at consumer dynamic IP addresses (and were not expected to be).

If you really want to enable RDP, I would require Network Level Authentication and filter out in the firewall of the local machine any incoming connection to 3389 not coming from some designated range which is the only you will ever RDP from (e.g. 192.168.33.89, using a RFC 1918 private address should make it harder that an unintended connection gets inadvertently routed from outside).

A point worth keeping in mind when designing this are all those companies that got infected by WannaCry on 2017… while nobody had smb port open from the internet.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .