Re: Remote Desktop MITM Concerns

From: JerryTheGreat (JerryTheGreat_at_discussions.microsoft.com)
Date: 06/13/05 

Date: Sun, 12 Jun 2005 21:21:02 -0700

Thank You both for you well thought-out input. I appreciate feedback
addressing my concerns.

JTS

"Steven L Umbach" wrote:

> I would not lose sleep if I were you. I still use TS accross the internet
> and don't worry about it. Since you are using an IP the threat is almost non
> existant as a user can not simply reconfigure their public IP to spoof you
> into connecting like they can a lan IP due to the way the internet is
> routed. Then always look at the worse case scenario as part of managing your
> risk. What would be the consequences if someone read your data? If it meant
> that people would die or be harmed, or a that customers credit card numbers
> could be obtained then you must use a l2tp VPN connection to mitigate the
> risk but my guess is that is not the case as hopefully you would already be
> doing such. --- Steve
>
>
> "JerryTheGreat" <JerryTheGreat@discussions.microsoft.com> wrote in message
> news:F74D73A1-CC31-4A0C-B854-31ADD2912793@microsoft.com...
> > What I really want to know here is this: How significant a concern is
> > this?
> > If the ability to perform the act is integrated into freely available
> > software should I be concerned? In my setup, I am logging in accross the
> > Internet, so IPSec is out, unless I set up a vpn. Mitigating the risk is
> > that
> > I use IP, not DNS to connect to the server, which should make a MOTM
> > extremely difficult to perform without detection.
> >
> > Thanks.
> >
> > JTG
> >
> > "Roger Abell" wrote:
> >
> >> I am with Steve in replying that, if you feel your environment of
> >> sufficient
> >> value that there actually is a risk someone would consider mounting an
> >> man
> >> in the middle compromise of your network communications, then you should
> >> look at use of a IPsec hard security association, in one or another form,
> >> and then use RDP within this.
> >>
> >> The underlying problem here is that RD is intended to allow ad-hoc type
> >> connections, such as with consumer stand-alones. When there is no third
> >> party involved and there is no pre-shared secret, then it is
> >> fundamentally
> >> unavoidable that the types of mutual verification this author indicates
> >> as
> >> the most desirable are not infallibly possible.
> >>
> >> --
> >> Roger Abell
> >> Microsoft MVP (Windows Security)
> >>
> >> "JerryTheGreat" <JerryTheGreat@discussions.microsoft.com> wrote in
> >> message
> >> news:F875A484-5C95-44D8-8829-E2400FCFCAC1@microsoft.com...
> >> > Hello,
> >> >
> >> > Released May 28 was an unofficial security advisory entitled "Remote
> >> Desktop
> >> > Protocol, the Good the Bad and the Ugly" By Massimiliano Montoro. This
> >> has
> >> > me very concerned about my setup. Is this a valid issue?? I've found
> >> > no
> >> > advisoried from Microsoft or any other security site, except that the
> >> > nefarious tool Cain and Abel v2.7 contains this capability. Please
> >> > someone
> >> > address this concern for me.
> >> >
> >> > I'm being careful in this posting not to use any keywords a search
> >> > engine
> >> > may index.
> >>
> >>
> >>
>
>
>

Relevant Pages

  • Re: proper config
    ... > internet says to me that you can't connect anything to the internet. ... > risk you aren't already pretty much taking. ... If you can't then you need to mitigate it ... >> to Exchange if you don't want to open up port 25 to the Exchange ...
    (microsoft.public.exchange.setup)
  • Re: Security
    ... help to get a little perspective on risk. ... Life is a risky business - no one gets out alive! ... internet is trivial by comparison. ... "ordinary" surfing including some high-risk surfing ...
    (alt.computer.security)
  • Re: [Full-Disclosure] Global HIGH Security Risk
    ... Basically you can't post any vuln without some risk attached, court rulings ... Internet is bound by US law. ... Global HIGH Security Risk ...
    (Full-Disclosure)
  • Re: [opensuse] Goodbye to suse and why not stay, The Linux Wall
    ... imagine an internet where all users know what they're doing... ... be the responsibility of a technology consumer. ... It's a sad fact that right now computing is so immature and yet so ... unwittingly exposing themselves to all manner of risk and hazard. ...
    (SuSE)
  • Re: comp.arch has made itself a sitting duck for spam
    ... practice of the industry favors farming the risk out--to the end buyer. ... Perhaps that's because the buyers accept the risk in preference to paying ... You bang on about everyone having to use the internet for ... look to the telephone network. ...
    (comp.arch)