3 ms·

In addition to other posters, firewall rules in Windows are far more permissive for internal networks than external ones. So if you have a setup where your lapt

In addition to other posters, firewall rules in Windows are far more permissive for internal networks than external ones. So if you have a setup where your laptop can RDP into your desktop with minimal credentials, someone gaining control of the router can access your desktop as well. If you do practice good security and require a username/password for the RDP session, the router can still spy on that traffic for the malicious remote. In addition, the remote can issue Remote Assistance requests. More nefariously, if your PC is not on the latest patch, which most PCs aren't, an exploit could be used to install a RAT or ransomware or equivalent. Are you using a NAS that is open to every machine on the internal network? If so, the remote will have a field day with your backups and shared data. In short, once the remote has gained access to your internal network, many types of attacks become possible.

heleninboodler 6y ago
> If you do practice good security and require a username/password for the RDP session, the router can still spy on that traffic for the malicious remote Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it), and they apparently still don't have it required by default, based on some blog posts I see from 2019 explaining how to force it on. That's shameful.
- gruez 6y ago
  >Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it) Since you seem to be an expert on this, can you explain how exactly it's implemented? When connecting to a remote machine, the sequence of events goes something like this: 1. enter ip, click "connect" 2. login prompt shows up 3. enter username/password, click "ok" 4. self signed certificate warning shows up, asks me to accept/reject the certificate 5. after accepting the certificate, the connection succeeds and I can see the other machine. This sequence of events makes me think that the password authentication step isn't done over TLS at all, or is done over TLS but is vulnerable to MITM attacks. Can you confirm/deny whether this is accurate?
  - heleninboodler 6y ago
    The part about the username/password appearing before the cert warning sounds wrong. I distinctly remember that all the RDP packets went inside the TLS connection. Perhaps they just delay the cert warning until after RDP has been started? I'm sorry but it's been 14 years and I've tried not to look at RDP in the interim. You may revoke my "expert" status. :D I'd guess that even with TLS enabled you're still vulnerable to MITM since hardly anyone is going to use certs that can actually be validated against a root.

heleninboodler 6y ago

> If you do practice good security and require a username/password for the RDP session, the router can still spy on that traffic for the malicious remote Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it), and they apparently still don't have it required by default, based on some blog posts I see from 2019 explaining how to force it on. That's shameful.

gruez 6y ago
>Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it) Since you seem to be an expert on this, can you explain how exactly it's implemented? When connecting to a remote machine, the sequence of events goes something like this: 1. enter ip, click "connect" 2. login prompt shows up 3. enter username/password, click "ok" 4. self signed certificate warning shows up, asks me to accept/reject the certificate 5. after accepting the certificate, the connection succeeds and I can see the other machine. This sequence of events makes me think that the password authentication step isn't done over TLS at all, or is done over TLS but is vulnerable to MITM attacks. Can you confirm/deny whether this is accurate?
- heleninboodler 6y ago
  The part about the username/password appearing before the cert warning sounds wrong. I distinctly remember that all the RDP packets went inside the TLS connection. Perhaps they just delay the cert warning until after RDP has been started? I'm sorry but it's been 14 years and I've tried not to look at RDP in the interim. You may revoke my "expert" status. :D I'd guess that even with TLS enabled you're still vulnerable to MITM since hardly anyone is going to use certs that can actually be validated against a root.