3

I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled).

I have applied the PCI settings of IISCrypto tool, but I have to leave TLS 1.0 enabled in order not to break RDP. The only "solution" I have been able to find is to not use TLS, but that makes little sense since legacy RDP Security Layer is less secure.

Another site suggested turning off all cipher suites that use CBC, but doing that broke RDP for me. I have also tried other suggested cipher settings, to no avail (also broke RDP).

This post seems to indicate that BEAST is not really an issue for RDP.

Can the BEAST vulnerability really be used to compromise RDP? Are there any exploits / has it ever been done?

Improve this question
2
  • Where did you turn off the CBC cipher suites? Make sure that the clients support whichever cipher suites you're switching to.
    – RoraΖ
    Feb 16, 2015 at 12:38
  • I turned them off using the IISCrypto Tool on a Windows 2008R2 server (and rebooted), then I tried to connect to it using RDP from a Windows 7 Pro station (RDP About Box: version 6.2.9200, Remote Desktop Protocol 8.0 supported), but could no longer connect).
    – Jim Balo
    Feb 16, 2015 at 16:58

1 Answer 1

Reset to default
1

A few things:

  • You might be interested in this link: - seems PCI compliance scanners get confused about these issues sometimes.
  • Technically Beast applies to Browsers, but CBC is not what you want for your ciphers anyway.
  • However, CBC mode is default for FIPS complient RDP anyway :(
  • Yes, you definitely want TLS.

Without some more specific information about your setup, it is very hard to say what is breaking RDP (maybe that's more of a stack overflow or server fault kind of question anyway.... in fact check out this thread

However...

  • You want TLS 1.x for sure. DO NOT DISABLE TLS
  • Do your best to get rid of all CBC ciphers. They have inherent issues.

In Summary

No, the Browser Exploit Against SSL/TLS isn't typically used against RDP, but you should disable CBC, and enable TLS anyway. With the right tweaks, it seems that the optimal set up is possible.

Improve this answer
1
  • Disabling CBC and enabling TLS was exactly what I tried (got it from the same link, serverfault.com/questions/461264/…). But after this I could not connect with RDP. Have you tried this yourself on Windows Server 2008 R2 (and then tried RDPing from Windows 7 Pro)?
    – Jim Balo
    Feb 16, 2015 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .