Yes, to a certain extent, all data is encrypted based on the setting in
Terminal Services Configuration, Connections, RDP-Tcp properties, General
tab, Encryption Level. (default is medium, I think). In all 3 possible
settings, upstream data is encrypted, which means that man-in-the-middle
packet sniffer attacks wouldn't recover passwords without bruteforce
decryption. Downstream data (video) is encrypted with settings medium and
high. I don't know the actual encryption level and algorithm, but I think
its similar to SSL. Once connected to Terminal Services, it is possible to
connect to all intranet resources available to the logged on user.
Jeffrey Clark
CIS-IT Major
----- Original Message -----
From: "net sec" <netsec9@hotmail.com>
To: <pen-test@securityfocus.com>
Sent: Tuesday, October 26, 2004 5:18 PM
Subject: TS/3389 risk on Internet
I have a peer that insists on allowing public access to his Domain
controller via TS/tcp 3389 over the internet. I know there are some
documented cases of 'man-in-the-middle' attacks for this service but I was
hoping someone here could help me plead my case as to why this is a bad
idea. Maybe you all disagree and regurlary allow this traffic. It just
doesn't sit well with me. Does anyone know if the login/password is sent
in clear text for TS authentication?
Thanks in advance for any thoughts,
Nicole
_________________________________________________________________
On the road to retirement? Check out MSN Life Events for advice on how to
get there! http://lifeevents.msn.com/category.aspx?cid=Retirement
------------------------------------------------------------------------------
Internet Security Systems. - Keeping You Ahead of the Threat
When business losses are measured in seconds, Internet threats must be
stopped before they impact your network. To learn how Internet Security
Systems keeps organizations ahead of the threat with preemptive intrusion
prevention, download the new whitepaper, Defining the Rules of Preemptive
Protection, and end your reliance on reactive security technology.
http://www.securityfocus.com/sponsor/ISS_pen-test_041001
-------------------------------------------------------------------------------
