Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is vulnerability to man-in-middle attacks, does this attack being eliminated?

  • Secure enough for what? All security risk is relative to the attack profiles applicable to your environment.
    – Polynomial
    Commented Jan 22, 2013 at 10:03
  • I just want to know any potential attacks exist?
    – user236501
    Commented Jan 22, 2013 at 10:15
  • Potential attacks always exist - if you are just asking "has the MITM attack been removed" the answer is best obtained from CVEdetails.com. If you have a specific risk profile, we could answer whether or not RDP 7.0 is secure for that profile...
    – Rory Alsop
    Commented Jan 22, 2013 at 11:20
  • What are those potential attacks?
    – user236501
    Commented Jan 22, 2013 at 11:45

2 Answers 2


With the latest version it is possible to integrate ssl/tls security and two factor authentication mechanisms. If the connection is used to connect to a remote desktop services portal (i.e. RD gateway), network level authentication can be enforced. With a properly planned and implemented infrastructure with a public key infrastructure, it is possible to harden the security. NLA provides more support for hardening the security. It is also possible to use 3 factor authentication methods. As the rule of thumb, each mechanism depends on the current security profile and attack surface. It depends on capabilities, implementations and continuous enhancements. So by just using the latest version, you cannot still ensure the security if it is not up to its standards.

Note: There could still be other issues such as vulnerabilities with certificates and CRL method, pkey export etc(as those do exist).


Recent versions of RDP support SSL/TLS. RDP itself has its own format for transferring data packets; within these packets, recent enough clients and servers can transport the TLS records which will encode a tunnel into which the actual data will be sent (including authentication). This is reasonably secure, insofar as the client and server do not botch the implementation or misuse the certificates (see this answer for some discussion on the subject).

Also, TLS usage is optional and subject to negotiation between client and server; conceivably, an attacker trying a man-in-the-middle attack could alter the first packets so as to simulate a lack of TLS support on both sides, leading to a connection without TLS. It is up to the client implementation to detect this occurrence and abort the connection (or raise a warning and let the user abort).

TLS support was added in RDP 5.2. Free opensource implementations of the RDP protocol usually do not support it.

Another way to TLS-protect a RDP session is the Remote Desktop Gateway (formerly known as Terminal Services Gateway) which encapsulates the whole thing into an SSL/TLS tunnel. This is cumulative with other features of RDP, so you can end up with TLS-in-RDP-in-TLS. The gateway is a specific service available from Windows Server 2008, and only Microsoft's client appears to support it (according to Wikipedia, not even the MacOS port of Microsoft's client can use it).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .