Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rdp]

Remote Desktop Protocol, a protocols for accessing Windows applications remotely

0
votes
0answers
32 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
0
votes
1answer
75 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
0
votes
0answers
30 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
1
vote
1answer
103 views

Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim

If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface. meterpreter > run getgui -u loneferret -...
6
votes
1answer
850 views

I'm hacked without telling anyone my ip [duplicate]

I have a pc with static IP bought from my ISP and RDP enabled. I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about ...
3
votes
0answers
34 views

Is it possible for a remote machine to “escape” from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
3
votes
2answers
104 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
1
vote
1answer
1k views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
0
votes
1answer
896 views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
23
votes
2answers
5k views

What are the risks of remoting in (RDP) to a compromised system? [duplicate]

Can the client be harmed in any way, and how?
-2
votes
2answers
170 views

Accidently watched content against company policy while connected to work using RDP

I was at home and had some work to be finished so I used IE connected remotely to my work PC finished the job but forgot to disconnect. After a while I started watch not-safe-for-work material in ...
5
votes
1answer
158 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
3
votes
1answer
245 views

Can passwords be brute-forced through RDP?

We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of ...
2
votes
1answer
70 views

Controlling windows server on Amazon Web Services

Our site is ISO-27001 compliant. As part of the compliance we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface. Our current ...
5
votes
2answers
346 views

Is there a way to see what is program is causing RDP attempts on computer

One of our servers (running RdpGuard) shows multiple failed attempts from specific users' machines (3 to be exact) and I can't figure out what is causing them. One user is local and two are remote ...
3
votes
2answers
2k views

Is open RDP really dangerous? [duplicate]

I have just started work for a small (100-150 employees) company. I noticed that anybody can remote in to the remote server using the correct domain, which is quite easy to guess based on the company ...
0
votes
0answers
34 views

I have a question on hardening my windows 8 host firewall rules

I use the following setup for my internet connection. MyPC/RDP -> RDS server -> Internet (this is over a paid public WiFi access point). What I want is to strengthen my Win 8 firewall rules (...
1
vote
0answers
541 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
-1
votes
1answer
105 views

Which of these configurations is better to stay anonymous on the internet? [duplicate]

MyPC > RDP > Windows VPS > Tor > Socks5 > Internet or MyPC with Tor sandboxed > socks5 > Internet. Which is better? Any better idea that doesn’t compromise on network speed?
0
votes
0answers
228 views

RDP - Why self signed certifcate is trusted on client-side?

Here is the issue I can't resolve. Remote RDP server presents a self-signed certificate, and I want to block any connection on client-side when RDP server is using non compliant certificate. I found ...
0
votes
1answer
264 views

RDP Audit Failures Brute Force Attacks

I need some help on tracking the source of these RDP access attempts on our terminal server. Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on ...
1
vote
1answer
2k views

Security Risk of Open RDP (3389)

I have often been told that allowing RDP access over the internet is a security risk - my understanding is that this logic stems from the idea that a potential hacker would brute-force the username ...
1
vote
1answer
355 views

Windows 7 RDP exposed to Internet

We are hosting a Windows 7 desktop Pro on a KVM machine, where a legacy software which does not run on a Windows Server 2008-16 is hosted. We are exposing it to Internet as users need to login once in ...
1
vote
3answers
140 views

Security of mapping Local Resources over RDP

I work with a group of developers that do network level program. To prevent these developers from accidentally causing problems on the corporate network they have been given there own isolated ...
0
votes
1answer
188 views

Windows Remote Desktop Tool

What are the security risks of allowing the Remote desktop connection to be enabled on machines within an organisation? From reading various blogs on the subject, I can stop the use of the MSTSC.exe ...
0
votes
1answer
82 views

Botnet tracing: Is SvcHost RemoteIP reliable or can it be spoofed?

On an RDP server, the "Resource Monitor" system app shows network connectivity by process in the "Overview" tab under "Network" section. In this section, I see an SvcHost process on TCP port 3389 for ...
3
votes
3answers
562 views

Improve RDP security: router with VPN or IP whitelist on firewall

I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly ...
0
votes
1answer
201 views

If TCP is more “secure” than UDP, how would a practical UDP “attack” look, for example during the initiation of a MS RDP connection?

In accordance to the recent question Why is TCP more secure than UDP?. How would an "attack" look when it comes to the practical aspect? A great example would be the use of TCP or UDP for Microsoft ...
0
votes
0answers
318 views

MitM-attack on RDP connection - how sophisticated can it get?

So I know how MitM-Attacks work against RDP now and I have a bit of abstract knowledge about MitM-attacks in general. As far as I understand, as an attacker you want to listen to the traffic of your ...
1
vote
1answer
149 views

How can I know if an attack is still valid, if there is no CVE for it?

I found a PoC for a MitM-attack towards RDP published in March 2017 but no CVE in any of the databases and no mention of a patch by Microsoft. I want to know if this still works, how would I find out ...
1
vote
2answers
540 views

Port forwarding and port blocking security concerns

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests ...
0
votes
1answer
129 views

What are the most common security threats that have to be considered when dealing with RDP? [duplicate]

I'm dealing with a hypothetical infrastructure for enabling workers to use RDP for remote access to their work PCs. These would be virtualized Win7 machines within a VMWare vSphere environment. ...
1
vote
1answer
83 views

Why Windows allows Administrator login via RDP by default?

Coming from a Linux background, this seems awful weird to me. Unlike Linux, where root login is denied by default in SSHd configuration, Windows users in Administrator group are allowed to login by ...
0
votes
1answer
5k views

How did hackers brute force my Windows server username?

About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about ...
0
votes
0answers
309 views

PCI DSS and Windows Terminal Servers and 2FA

We are using a Windows Terminal Server farm (providing security function) to access servers in the CDE. CDE is segregated (VLAN/IP/FW) also the TS farm is segmented (VLAN/IP/FW). The only way to ...
1
vote
1answer
64 views

Dedicated application server security

I'd like to expose a machine running Windows Server 2012 to the internet. I plan to run a single application that uses a specific port (say 12345) and then use RDP through 3389 to logon and manage it. ...
0
votes
1answer
656 views

Is RDP secure enough? China/HK Access [duplicate]

I have offices in China and HK and for local internet all fine. International connectivity is very slow indeed - not usable. They need to access a terminal server in the UK and do this by using SSLVPN ...
8
votes
2answers
23k views

Is Two Factor Auth for RDP possible?

Is two factor authentication possible when using RDP with a Windows server, say by using a time dependent code?
82
votes
10answers
29k views

How secure is RDP?

I have a sort of a conflict with my company's Security Lead Engineer. He says that Remote Desktop Protocol (RDP) is not secure enough and we should be using TeamViewer instead. We use RDP not only to ...
0
votes
1answer
534 views

rdp connection with netcat pivoting

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...
4
votes
2answers
890 views

Brute Force RDP Attacks Despite Having RDP Restricted to 1 IP - HOW?

I restricted the Firewall incoming rules for RDP under Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. This action ...
2
votes
2answers
183 views

Email hacks via RDP

Someone has sent an email from my account that is making me look bad. I am trying to determine if someone either actually did it physically from my computer or via RDP. As there is reason to believe ...
10
votes
6answers
5k views

RDP Attempts From Unknown IPs, How to Protect?

I'm running Windows Server2008 R2, and seeing the following error multiple times with various IPs in the event log: The Terminal Server security layer detected an error in the protocol stream and ...
0
votes
1answer
107 views

Stolen Remote Desktop Protocol (RDP) credentials

I would like to know how to guard against RDP-renting services such as dedicateexpress.com which rents out stolen corporate laptops credentials. Are there IDS for such events?
0
votes
1answer
240 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
1
vote
3answers
850 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
1
vote
0answers
565 views

Tunneling rdp over ssh as a network newbie

For whatever reason I need to access a virtual machine (Windows server 2008r2) on my home network from outside the network over the internet via remote desktop. I read that there are "concerns" with ...
2
votes
1answer
10k views

How to get more information on TermDD Security Layer Disconnects (Event 56)

In my Admin event log, I see the following errors: The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: XXX.XXX.XXX.XXX ...
2
votes
3answers
1k views

Unauthorized remote control performed today - teamviewer?

I came home a bit ago from an overnight trip and saw my PC screen moving around. I hoped it was just some ad animation but as I sat down I realized someone was opening 30+ tabs in my Chrome to an ...
1
vote
0answers
94 views

Under which circumstances is the default security profile of XRDP considered okay?

In xrdp.ini, the base install of xrdp on my raspberry pi*, there I have the following below. I changed crypt_level to high. [globals] bitmap_cache=yes bitmap_compression=yes port=3389 crypt_level=...