3

I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled).

I have applied the PCI settings of IISCrypto tool, but I have to leave TLS 1.0 enabled in order not to break RDP. The only "solution" I have been able to find is to not use TLS, but that makes little sense since legacy RDP Security Layer is less secure.

Another site suggested turning off all cipher suites that use CBC, but doing that broke RDP for me. I have also tried other suggested cipher settings, to no avail (also broke RDP).

This post seems to indicate that BEAST is not really an issue for RDP.

Can the BEAST vulnerability really be used to compromise RDP? Are there any exploits / has it ever been done?

  • Where did you turn off the CBC cipher suites? Make sure that the clients support whichever cipher suites you're switching to. – RoraΖ Feb 16 '15 at 12:38
  • I turned them off using the IISCrypto Tool on a Windows 2008R2 server (and rebooted), then I tried to connect to it using RDP from a Windows 7 Pro station (RDP About Box: version 6.2.9200, Remote Desktop Protocol 8.0 supported), but could no longer connect). – Jim Balo Feb 16 '15 at 16:58
1

A few things:

  • You might be interested in this link: - seems PCI compliance scanners get confused about these issues sometimes.
  • Technically Beast applies to Browsers, but CBC is not what you want for your ciphers anyway.
  • However, CBC mode is default for FIPS complient RDP anyway :(
  • Yes, you definitely want TLS.

Without some more specific information about your setup, it is very hard to say what is breaking RDP (maybe that's more of a stack overflow or server fault kind of question anyway.... in fact check out this thread

However...

  • You want TLS 1.x for sure. DO NOT DISABLE TLS
  • Do your best to get rid of all CBC ciphers. They have inherent issues.

In Summary

No, the Browser Exploit Against SSL/TLS isn't typically used against RDP, but you should disable CBC, and enable TLS anyway. With the right tweaks, it seems that the optimal set up is possible.

  • Disabling CBC and enabling TLS was exactly what I tried (got it from the same link, serverfault.com/questions/461264/…). But after this I could not connect with RDP. Have you tried this yourself on Windows Server 2008 R2 (and then tried RDPing from Windows 7 Pro)? – Jim Balo Feb 16 '15 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.