|
Posted by Roger Abell on June 12, 2005, 1:11 pm
Please log in for more thread options Not using DNS does much reduce the ability to mount a mitm attack,
but even with DNS doing so is not at all a trivial effort (except in
some reduced complexity situations).
Using the internet does not in and of itself mean that one cannot
use IPsec. In fact, IPsec was invented _for_ the internet.
Personally, I would not worry about it, especially as the leverage
point most easily used to effect the injection (DNS) is not a factor
in your case. Even if you were using DNS name resolutions, the
effort needed in the open network would imply that you were the
had been identified as a high value target.
--
Roger Abell
Microsoft MVP (Windows Security)
> What I really want to know here is this: How significant a concern is
this?
> If the ability to perform the act is integrated into freely available
> software should I be concerned? In my setup, I am logging in accross the
> Internet, so IPSec is out, unless I set up a vpn. Mitigating the risk is
that
> I use IP, not DNS to connect to the server, which should make a MOTM
> extremely difficult to perform without detection.
>
> Thanks.
>
> JTG
>
> "Roger Abell" wrote:
>
> > I am with Steve in replying that, if you feel your environment of
sufficient
> > value that there actually is a risk someone would consider mounting an
man
> > in the middle compromise of your network communications, then you should
> > look at use of a IPsec hard security association, in one or another
form,
> > and then use RDP within this.
> >
> > The underlying problem here is that RD is intended to allow ad-hoc type
> > connections, such as with consumer stand-alones. When there is no third
> > party involved and there is no pre-shared secret, then it is
fundamentally
> > unavoidable that the types of mutual verification this author indicates
as
> > the most desirable are not infallibly possible.
> >
> > --
> > Roger Abell
> > Microsoft MVP (Windows Security)
> >
message
> > > Hello,
> > >
> > > Released May 28 was an unofficial security advisory entitled "Remote
> > Desktop
> > > Protocol, the Good the Bad and the Ugly" By Massimiliano Montoro.
This
> > has
> > > me very concerned about my setup. Is this a valid issue?? I've found
no
> > > advisoried from Microsoft or any other security site, except that the
> > > nefarious tool Cain and Abel v2.7 contains this capability. Please
someone
> > > address this concern for me.
> > >
> > > I'm being careful in this posting not to use any keywords a search
engine
> > > may index.
> >
> >
> >
| 
XML Sitemap