Microsoft Terminal Services vulnerable to MITM-attacks.

[Erik Forsberg]

During extensive investigation of the Remote Desktop Protocol (RDP),
the protocol used to connect to Windows Terminal Services, we (Cendio
Systems) have found that although the information sent over the network is
encrypted, there is no verification of the identity of the server when
setting up the encryption keys for the session.

This means RDP is vulnerable to Man In The Middle attacks (from here
on referred to as MITM attacks). The attack works as follows:

1) The client connects to the server, however by some method (DNS
spoofing, arp poisioning, etc.) we've fooled it to connect to the
MITM instead. The MITM sends the request further to the server.
2) The server sends it's public key and a random salt, in cleartext,
again through the MITM. The MITM sends the packet further to the
client, but exchanges the public key to another one for which it
knows the private part.
3) The client sends a random salt, encrypted with the server public
key, to the MITM.
4) The MITM deencrypts the clients random salt with it's private key,
encrypts it with the real servers public key and sends it to the
server.
5) The MITM now know both the server and the client salt, which is
enough information to construct the session keys used for further
packets sent between the client and the server. All information
sent between the parts can now be read in cleartext.

The vulnerability occurs because the clients by no means try to verify
the public key of the server, sent in step 2 above. In other
protocols, such as the Secure Shell protocol, most client
implementations solve this for example by letting the user answer a
question whether a specific serverkey fingerprint is valid.

The clients we've seen so far for RDP have no way to preinsert a known
server key. There is also no interaction with the user in order to
verify a key the first time a connection is made to a new server.

We have communicated with Microsoft in this matter, and they
confirmed 2003-03-19 that the problem do exist in their current
implementation. They are currently "investigating the feasability in
adding this functionality". They also point out that they do not claim
RDP having the functionality of providing server authentication.

We feel that Microsoft is not taking this seriously enough. We know
there are sites using Terminal Services to transfer sensitive data,
and we feel that they need to be informed about this vulnerability in
order to be able protect their networks. This is why we publish this
information at this moment.

We've tested this vulnerability against Windows 2000 Terminal Server,
Windows 2000 Advanced Server and the upcoming Windows Server 2003
using both the clients delivered with Windows 2000 and the latest
downloadable RDP client from Microsoft. We have reason to believe that
the vulnerability exists when running both RDP version 4 and 5, and
regardless of terminal server mode.

We have developed software that can be used to exploit this
vulnerability, but we choose not to release it.

\EF
--
Erik Forsberg Telephone: +46-13-21 46 00
Cendio Systems Web: http://www.thinlinc.com

[Larry Seltzer]

>>RDP is vulnerable to Man In The Middle attacks (from here on referred to as MITM
attacks). The attack works as follows:

Do you know if ICA (Citrix products) is also vulnerable?

LJS

[Erik Forsberg]

"Larry Seltzer" <larry@larryseltzer.com> writes:

> >>RDP is vulnerable to Man In The Middle attacks (from here on referred to as MITM
> attacks). The attack works as follows:
>
> Do you know if ICA (Citrix products) is also vulnerable?

We haven't investigated the ICA protocol, so basically, we don't
know. However, a Google search on "secureica man in the middle attack"
gives some rather interesting results.

There seems to be many different ways of connecting to Citrix
MetaFrame servers. SecureICA is only one of them.

\EF
--
Erik Forsberg Telephone: +46-13-21 46 00
Cendio Systems Web: http://www.thinlinc.com

[Devin Heitmueller]

The ICA Protocol is also vulnerable. They use Diffe-Hellman for key
agreement. But there is no PKI in the protocol to verify the identity
of the server.

It's harder (because less of ICA has been reversed engineered), but it
is possible.

On Wed, 2003-04-02 at 19:09, Larry Seltzer wrote:
> >>RDP is vulnerable to Man In The Middle attacks (from here on referred to as MITM
> attacks). The attack works as follows:
>
> Do you know if ICA (Citrix products) is also vulnerable?
>
> LJS
--
Devin Heitmueller
Senior Software Engineer
Netilla Networks Inc

[Henrik Storner]

In <1049409543.15153.6.camel@devinlinux.netilla.com> Devin Heitmueller
<dheitmueller@netilla.com> writes:

>On Wed, 2003-04-02 at 19:09, Larry Seltzer wrote:
>> >>RDP is vulnerable to Man In The Middle attacks
>>
>> Do you know if ICA (Citrix products) is also vulnerable?
>
>The ICA Protocol is also vulnerable. They use Diffe-Hellman for key
>agreement. But there is no PKI in the protocol to verify the identity
>of the server.

AFAIK, Citrix' recommendation if you want to guard against this
type of attack is to use their Citrix Secure Gateway software,
which tunnels the ICA protocol data inside an SSL connection.
This uses the normal SSL certificate handshake to verify the
identity of the server.


Henrik Storner

[Carlos Branco]

In-Reply-To: <uod6k5g9fr.fsf@hostname.lkpg.cendio.se>


>This means RDP is vulnerable to Man In The Middle attacks (from here
>on referred to as MITM attacks).


Great piece of research by Erik Forsberg and his team. However, this
vulnerability does NOT affect Remote Desktop Web connection (aka TSAC),
when used with SSL. This is because the RDP web client would rely on the
Server-Side SSL cert to prove the authenticity of the server, making MTM
attacks "virtually" impossible.

Anyway, if you're deploying RDP and are worried about this exploit,
try running it over SSL. More information can be found at:
//www.microsoft.com/windows2000/server/evaluation/news/bulletins/tsac.asp

Carlos Branco, CISSP