Re: Remote Desktop Command Fixation Attacks

pdp (architect) wrote:
The attack is rather simple. All the bad guys have to do is to compose
a malicious RDP (for Windows Terminal Services) or ICA (for CITRIX)
file and send it to the victim. The victim is persuaded to open the
file by double clicking on it. When the connection is established, the
user will enter their credentials to login and as such let the hackers
in. Vicious!

So, "all you have to do" is persuade the user to run an attachment and type in credentials. Wouldn't it be simpler to just email the user a batch file and have them run it? Why not just use the same message from "Tim from Tech Department" and substitute a web page for the RDP file?

It's not clear from your article, but I assume you're having the user connect to their normal Citrix or TS farm to run the program. First, why in the world would you give users administrative rights on your servers? Secondly, why wouldn't you use software restriction policies to whitelist only allowed apps on your server?

> I will show you how easy it is to compromise a well protected Windows Terminal or CITRIX server

No, you showed how to compromise a poorly-configured TS or Citrix server.

> Security in depth does not exist!

Sounds more like shallow configurations.

Relevant Pages

  • Re: Secure Access - [WP]
    ... How can I confiugre/make sure they only logon to the Citrix Server. ... access other resouces on our network and in the domain???? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Secure Access - [WP]
    ... How can I confiugre/make sure they only logon to the Citrix Server. ... users are in a different company and I don't know what client OS they are ...
    (microsoft.public.windows.server.active_directory)
  • Re: Prevent roaming profiles roaming to Citrix / TS server
    ... We put our citrix server in ts own gpo and created a GPO just for it, ... relating to folder redirection. ... The rest of the Roaming Profiles seem to be working sweetly, ...
    (microsoft.public.windows.server.general)
  • Re: pf and citrix ica
    ... Greg - thanks again for the reply. ... I know the mask is OK on the Citrix server. ... hops away and if I use the same IP address as the pf firewall for my client ...
    (comp.security.firewalls)
  • Re: Kallal-printercode - works with Citrix?
    ... So the app is running on a Citrix server now. ... Terminal Sever / Citrix administrators don't understand Access and will ...
    (comp.databases.ms-access)
Loading