« previous 1 2 3 next »

Duplicated

The later versions of the client software based on RDP v5.2 improved the earlier version slightly: the server now identified itself to the client with a certificate. This meant that the original MITM attack was no longer possible. Unfortunately though, as Massimiliano Montoro demonstrated, Microsoft had not done its homework thoroughly enough [1].

The server produces the certificate by signing its public key with a private key. This private key is, however, hard-coded into the file mstlsapi.dll. This DLL can be found in every Windows XP, Windows 2000 Server and Windows 2003, and the key is always the same.

This makes it possible to use the "old" method of attack with a few minor modifications. The computer in the MITM position only has to sign its own certificate with the key from its own DLL and send it on to the client. This is accepted without any further reply on either the client or server side.

With just a few mouse clicks, Cain & Abel reroutes the RDP traffic through

The security auditing tool "Cain & Abel" supports this MITM attack since version 2.7 [2]. The computer to be eavesdropped upon can be easily selected with just a few mouse clicks; the traffic is automatically intercepted by the tool, and also decrypted. In our tests, the log file included the keystrokes of the administrators who were logging on. With this information, the passwords would have been very easy to reconstruct.

In the log file, all keystrokes are recorded, including the password.

« previous 1 2 3 next »