Hot answers tagged

90

I believe that Teamviewer is a proxy service for tunnelled VNC connections. Hence, the first security consideration with regard to that service is that it is MITM'ed by design. There have been suggestions that the service was compromised a couple of months ago. (Note that although VNC uses encryption, the entire exchange is not, by default, encapsulated - ...


71

Edit: According to the comments there seems to be combination of configuration options in the enterprise edition of TeamViewer which might reduce my concerns. Since I have never used those, I cannot give an assessment about those and how well they work. According to the comments it might to be a buggy solution. I am a server admin (Windows and Linux) and I ...


40

A true story When I was in grad school the computer systems in our department were hacked. It turned out it was hacked because a malicious attacker got a hold of the username/password for one of our users, connected in, and then managed privilege escalation from there. Being young and naive I made a comment to my advisor along the lines of "Who can be ...


36

In addition to the other great answers, TeamViewer offers less physical security because it requires that the screen is unlocked in order to facilitate a remote session. That is, anyone walking past a keyboard and monitor of a remotely administered session can observe it and possibly take over the session should the remote user not be paying attention. ...


34

I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about it The entire Internet is regularly port scanned, both by malware, attackers and researchers such as shodan.io. You can not expect any service accessible to the Internet to be unidentified for more than seconds after ...


26

To begin, I know nothing about TeamViewer, so I won't attempt to comment on it. Historical RDP servers used "RDP Security", which is indeed a broken protocol and vulnerable to MITM. Don't do that. Even 2003r2 can do TLS for RDP, so there is no modern reason you should be forced to use RDP Security. Modern Servers will support TLS, so the security of ...


26

There are a number of settings in the standard RDP client that could be exploited for an attack on the client, if enabled. For example: shared folders, access to devices like printers, etc. If you're remoting into a known compromised machine, you might want to disable as much as possible in the client's connection and sharing options before connecting. It'...


16

The standard commercial router you mentioned do not allow any incoming connection from outside to the inside of the network. You need to specify allow the incoming connections through port forwarding. If you want to connect to the PC through the same network i.e. both tablet and PC are connection to the same local area network, you don't need to worry about ...


16

Assuming that you're using a modern version of RDP and configure it correctly (e.g. enable NLA, sort out proper certificates) the main risk of exposing it directly to the Internet tends to be the problem of exposing a username/password authentication system to the Internet, which is that you're allowing attackers to attempt to brute-force Active Directory ...


13

It turns out my previous assumption was correct. These DDoS "attacks" are actually a side-effect of a Makost[dot]net-style botnet and is NOT the intention of the attacker (in fact, they seem specifically designed NOT to cause a disruption of service which would make us aware of their activity). The attacks are in fact trying to gain access to my servers in ...


12

RDP is a complex protocol which requires complex implementations, and thus likely to contain bugs. The initial versions of the protocol did not include much encryption. Ulterior versions are better, and can use either a homemade encryption system (which may or may not use a certificate to embed the server public key), or SSL/TLS (which necessarily uses a ...


12

When you say "Welcome" screen with all users listed. Is that so, or is it one named user and then "Other user"? If it is one named user and "Other user" then the named user is actually coming from the RDP client and is not being exposed. Depending on which client you are connecting with, but at least the Win XP client will save last connected user on the ...


10

Not exactly proven security, but Port Knocking can allow you to open up closed ports by sending a special set of packets to the server first. You could also rent out a cheap server with a dedicated IP address and set up a VPN, then explicitly set the firewall to only allow connections from the VPN IP.


10

I'll expand on Daniel Bungert's explanation of protocols involved and why they work together. Having written a MitM proxy for RDP, I'm very familiar with the inner workings of most protocols involved. (More than I'd like to be...) You can configure it to only operate over TLS. This offers great security in it's own right, every message is wrapped with TLS ...


9

By "open on their router" I assume you mean open to the Internet. I'd advise against this. Remote Desktop Protocol is susceptible to known attacks. Also you say "patched", but even as recently as last week Microsoft issued a security bulletin against RDP: This security update resolves two privately reported vulnerabilities in the Remote Desktop Protocol....


8

Most of the RDP attacks are being targeted on standard 3389 port. Changing that port to any non-standard port like 8123 will make your remote desktop service listening to it. How-to-change-the-listening-port-for-Remote-Desktop Once you change it, you will need to specify the port number while initiating remote desktop connection. eg. IPaddress:8123


7

You should make sure that you are using RDP with the strongest encryption levels enabled. You should also consider using the built-in windows firewall (see how to set this up with advanced settings) or another firewall to only allow connections from your tablet. You can also ensure that your router doesn't allow the RDP port from the Internet. Other options ...


7

Update: The question has since it was originally posted been edited to highlight one difference, namely that RDP v6 over TLS is used. While the answer may still be considered "okay", I must now argue that tunneling TLS over SSH is unnecessary due to a lack of relevant and likely threat-scenarios - assuming correct configuration of TLS certificates etc. In ...


7

Yes, it is possible. If you want to have two factor authentication, which is naively supported by Windows, you could chose to use smart cards or virtual smart cards. As far as I know, to get one time passwords for RDP authentication you'll have to use third party solutions. For example, you could try Duo security Duo Authentication for Windows Logon and ...


6

You've got two choices: Cut and run Dig deeper Option 1 involves physically unplugging the machine from the network, then treating it as hostile. It's been infected, therefore it's no longer your computer. Grab whatever files you need from it via a live CD, and wipe the drive. Make sure to run an up-to-date AV over the files you copy, just in case they've ...


6

I'd go with some kind of VPN from the user's remote computer to a firewall at work, and then run RDP over that encrypted link. Problem with leaving a port open is that eventually it is found, and you'll have brute-force login attempts. Either that will just slow your environment down, or it will lead to accounts being locked out, or they find a username ...


6

This started as a comment. It's important to point out the "Who's at fault question". If you use a third party service and they fail to provide it's their failure to provide. If you use something in house and it fails, now it's the house's fault. Such distinctions carry a lot of weight. It might not mean anything to actual security, but that can sometimes ...


5

RDP has some issues, but these are broadly mitigated by getting the config right. Wicked Clown demonstrated a wonderful privilege escalation attack from restricted user to admin in less than 5 minutes at the recent B Sides London security conference which relied on a common misconfiguration - paper here. TLS can provide a strongly authenticated tunnel - ...


5

I advise against exposing internal servers directly to the Internet. Remote code execution vulnerabilities crop up too frequently for comfort and direct exposure of internal hosts. That said you can mitigate the risks somewhat with a few steps (these are not alternatives, they are layered complementary defenses): Perimeter firewall enforcing white list of ...


5

You may want to check out RDPGuard (Essentially fail2ban for rdp) and of course try your best to enforce a good password policy.


5

I realize that this question has already been marked as answered, but Microsoft has a service included in Server 2008 R2 called Microsoft TS (or RDP) Gateway What this does is allow you to put another server (the Terminal Services Gateway) in front of your actual terminal server which listens on TCP 443 rather than 3389. In addition to cloaking the ...


4

The first thing you should do is physically disconnect the computer from the network. You might think simply "pulling the plug" would be better from the security point of view and you'd be right. However, by pulling the plug you lose valuable forensic data. You should then notify the person responsible for IT Security of your computer. If that person is you, ...


4

There are a few items in addition to what you've written that I would add. Rename your admin account - Yes this might be a pain in the ass (especially if you've got services using the domain admin account) however this is a commonly attempted brute force username. Rename this account to something ambiguous that won't easily be guessed. Don't use common ...


4

I think the previous answers are correct but should be presented in a different light... let me explain. If you give the user access to view some piece of information, no technological safeguard will prevent them from funneling the data out. For example, I could Citrix into a machine with Cardholder Data and simply write it down on a piece of paper. Please ...


4

Depending on the configuration, there may be the ability to copy and paste to a local document. This could become a compliance issue depending on your industry. Say for example you deal with credit card numbers, social security numbers, etc. Someone could copy that data into an email or text file. It really depends on what kind of data you need to protect. ...


Only top voted, non community-wiki answers of a minimum length are eligible