Been a while since the last security post, so while its a blogging day...
I was catching up on
PaulDotCom security weekly podcast and during a discussion about insecure protocols like Telnet "behind the firewall" I learned that the RDP ("
Terminal Services") is vulnerable to
Man in the Middle (MITM) attacks. In fact they put RDP into the same group as Telnet!
I remember when I started allowing RDP into my home network I did some research into if the encryption used by RDP is secure -which it is- but
this vulnerability highlights that it is not enough and that it is exploitable by means of ARP Posion Routing to intercept your RDP session, including what you type at the login prompt.
So RDP is a bit of a fact of life for me at the moment, applying some defense in depth is in order. Some layers we could add:
- Tunnel the RDP connection over SSH. I really like this one because it adds a layer of authentication to the session, not just encryption. This addresses the root cause of the problem: So long as the encryption remains in place, RDP does not care how the traffic gets there.
- Tunnel the RDP connection over SSH. Yeah, but this time it is to allow us to close port 3389, there by not advertising the availability of RDP on the host.
- IP FIltering & IPSec policy. In my case I already have this in place for my off-site connections to only allow connections from know-good IP addresses. This is equally valid for behind the firewall sessions.
- Certificates. I'm a big fan of certificates as a factor to authentication. I'll blog one day about using them to encrypt SQL Server's on-wire protocol. Technet has a how-to that shows you how to set this up with Windows 2003 Server SP1 & Windows XP.