1. Remote Desktop Security Raghav Chawla, Jon Ussery Group 20

2. What is Remote Desktop? Remote administration software Remote administration software Ran on foreign host’s server Ran on foreign host’s server Displayed locally Displayed locally

3. Motivation Very popular Very popular Increasingly mobile society Increasingly mobile society Need to access home/work PCs Need to access home/work PCs Extremely vulnerable Extremely vulnerable Easy to exploit these vulnerabilities Easy to exploit these vulnerabilities Complete access Complete access

4. How Does it Work? For Microsoft services: For Microsoft services: Terminal services allow user to access data and applications on a remote computer Terminal services allow user to access data and applications on a remote computer Different than appstreaming, as computations are processed on remote pc Different than appstreaming, as computations are processed on remote pc

5. History (Microsoft software) Terminal services were introduced in Windows NT 4.0 Terminal services were introduced in Windows NT 4.0 Vastly improved in Windows 2000 Vastly improved in Windows 2000 Vista has new developments as well Vista has new developments as well Clipboard Clipboard Audio Audio

6. Differences In client versions of Windows OS, only one user can be logged in at a time In client versions of Windows OS, only one user can be logged in at a time In the server version, concurrent sessions are allowed In the server version, concurrent sessions are allowed Terminal Services provide for remote software access Terminal Services provide for remote software access

7. In Action Runs on port 3389 Runs on port 3389 Includes ActiveX control Includes ActiveX control Winlogon.exe authenticates user Winlogon.exe authenticates user Keyboard and mouse inputs are transmitted via TCP connection Keyboard and mouse inputs are transmitted via TCP connection Virtual Channels allow other devices to work (such as printers, audio, etc.) Virtual Channels allow other devices to work (such as printers, audio, etc.)

8. Some Software Distributions Microsoft Remote Desktop Connection Microsoft Remote Desktop Connection RealVNC RealVNC TightVNC TightVNC Apple Remote Desktop (for Apple pc’s) Apple Remote Desktop (for Apple pc’s) GoToMyPC GoToMyPC

9. Software Comparison

10. The Lab Hacking into remote desktop Hacking into remote desktop Remotely Enabling remote desktop Remotely Enabling remote desktop Multiuser remote desktop hack Multiuser remote desktop hack Hacking through a firewall Hacking through a firewall Security measures Security measures

11. Hacking into Remote Desktop Transferred WinVNC files on remote pc Transferred WinVNC files on remote pc Used RegINI.exe to load data (password, socket connections) into registry Used RegINI.exe to load data (password, socket connections) into registry Installed VNC through command prompt Installed VNC through command prompt

12. Enable Remote Desktop via Network Use Regedit to connect to the Network registry Use Regedit to connect to the Network registry

13. Find client machine on network Find client machine on network After a few registry edits, remote desktop functionality will be available After a few registry edits, remote desktop functionality will be available

14. Multiuser Desktop Hack Boot Windows in safe mode Boot Windows in safe mode Changed terminal services settings Changed terminal services settings Replaced termsrv.dll files with alternate Replaced termsrv.dll files with alternate

15. Multiuser Hack (cont.) Changed some registry settings Changed some registry settings Finally, tweak Terminal Services settings Finally, tweak Terminal Services settings

16. Hacking Through A Firewall Useful if port 3389 is blocked Useful if port 3389 is blocked Used Putty to setup a tunnel for accessing RDC Server Used Putty to setup a tunnel for accessing RDC Server

17. Security Measures Limit users who can log on remotely Limit users who can log on remotely

18. Security Measures (cont.) Set an account lockout policy Set an account lockout policy

19. Security Measures (cont.) Require passwords and at least 128-bit encryption Require passwords and at least 128-bit encryption Run - %SystemRoot%\system32\gpedit.msc /s Run - %SystemRoot%\system32\gpedit.msc /s

20. Security Measures (cont.) Change the RDP port number Change the RDP port number Edit registry as follows: Edit registry as follows: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

21. Other Tools

22. Loopback!

23. Any Questions?