Is anyone familiar with the RDP implementation on Windows and how it handles privilege separation pre and post authentication? Niels Provos, Markus Friedl, Pet

Is anyone familiar with the RDP implementation on Windows and how it handles privilege separation pre and post authentication? Niels Provos, Markus Friedl, Peter Honeyman released a paper in 2003 that analysed the number of privileged (8,391) vs. unprivileged (17,589) lines of code that are executed by OpenSSH [1]. These figures included calls to libraries such as OpenSSL and zlib. A key point from the paper: "Privilege separation prevents known security vulnerabilities in prior OpenSSH versions including some that were unknown at the time of its implementation." OpenSSH has changed significantly over the past decade and I haven't been able to locate more recent analysis of the privileged:unprivileged LoC ratio in OpenSSH. For the brave, the source code provides a good indication of the current state of OpenSSH[2] and the amount and type of code executed in privileged and unprivileged modes. Privileged mode is needed to open low numbered ports (<1024), read/process the private host key and fork new processes post authentication assuming the identity of another user. A great deal of effort and research has been put into ensuring that only the minimal amount of privileged code is executed. Where OpenSSH code can be executed within an unprivileged process, it is. RDP appears to have a much longer and significantly more complex session initiation process [3]. MS12-020[4] indicates the vulnerability occurs during the pre-authentication stage (Client MCS Connect Initial PDU with GCC Conference Create Request [5]). Thus it appears the RDP implementation on Windows doesn't utilise granular privilege separation pre-authentication? How about post-authentication privilege separation? Privilege separation is very important. I rephrase the question (assuming Microsoft's implementation doesn't utilise granular privilege separation by default): "Who could possibly be so stupid as to recommend or use RDP on the open internet knowing the implementation doesn't have granular and well designed privilege separation?" [1] http://www.citi.umich.edu/u/provos/papers/privsep.pdf http://www.citi.umich.edu/u/provos/papers/privsep.pdf [2] http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd.c?annotate=1.388 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd.c... [3] http://msdn.microsoft.com/en-us/library/cc240452%28v=prot.10%29.aspx http://msdn.microsoft.com/en-us/library/cc240452%28v=prot.10... [4] http://aluigi.org/adv/termdd_1-adv.txt http://aluigi.org/adv/termdd_1-adv.txt [5] http://msdn.microsoft.com/en-us/library/cc240836%28v=prot.10%29.aspx http://msdn.microsoft.com/en-us/library/cc240836%28v=prot.10...