Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major security flaw undermines Apple and Google users, researchers discover

washingtonpost.com

Post reply on HN
Print view View original

21–24 of 24 posts

Re: Major security flaw undermines Apple and Google users, researchers discover

#21

Post by geofft »

rogerbinns wrote: post #10
AnimalMuppet wrote: post #4

The story has a familiar ring. Back in the day, Microsoft stored passwords in a fairly insecure format. Then they got security religion, and improved the strength of their password storage dramatically. It was very hard to crack the new format. (I don't remember exactly, but this would have been somewhere around when NT came out.) But Microsoft was always big on backward compatibility. They wanted users of old machin…

I worked on reverse engineering Microsoft's remote desktop protocol (RDP) back in the day. It was wrapped in encryption much like how SSL operates. France outlawed encryption except for authentication, so you just had to put the client and the server in the French country setting and then man in the middle the tcp connection. Reverse engineer away. Thanks France!

Ah, is that what the "Disable encryption. This option is only needed (and will only work) if you have a French version of NT TSE." option to rdesktop(1) means. I always wondered about that!

Re: Major security flaw undermines Apple and Google users, researchers discover

#22

Post by rogerbinns »

yuhong wrote: post #17
rogerbinns wrote: post #10

Earlier quoted context omitted.

I worked on reverse engineering Microsoft's remote desktop protocol (RDP) back in the day. It was wrapped in encryption much like how SSL operates. France outlawed encryption except for authentication, so you just had to put the client and the server in the French country setting and then man in the middle the tcp connection. Reverse engineer away. Thanks France!

Of course, the private key turned out to be hardcoded anyway.

It was more akin to a self signed certificate, but also more complicated depending on domain setup. But also things changed a lot between RDP protocol versions.

It did take me quite a while to reverse engineer the encryption. It was mostly done using IDA Pro and SoftIce. The hardest bit was because I had several crypto books, and whichever Microsoft employee implemented their security kept doing what the books said not to do, so I'd never expect to keep encountering the "wrong" way of doing things.

https://www.hex-rays.com/products/ida/index.shtml

https://en.wikipedia.org/wiki/SoftICE

Re: Major security flaw undermines Apple and Google users, researchers discover

#23

Post by yuhong »

rogerbinns wrote: post #22
yuhong wrote: post #17

Earlier quoted context omitted.

Of course, the private key turned out to be hardcoded anyway.

It was more akin to a self signed certificate, but also more complicated depending on domain setup. But also things changed a lot between RDP protocol versions. It did take me quite a while to reverse engineer the encryption. It was mostly done using IDA Pro and SoftIce. The hardest bit was because I had several crypto books, and whichever Microsoft employee implemented their security kept doing what the books said n…

http://www.rapid7.com/db/vulnerabilities/windows-rdp-constan...

I think the newer RDP versions uses TLS BTW.

Re: Major security flaw undermines Apple and Google users, researchers discover

#24

Post by rogerbinns »

yuhong wrote: post #23
rogerbinns wrote: post #22

Earlier quoted context omitted.

It was more akin to a self signed certificate, but also more complicated depending on domain setup. But also things changed a lot between RDP protocol versions. It did take me quite a while to reverse engineer the encryption. It was mostly done using IDA Pro and SoftIce. The hardest bit was because I had several crypto books, and whichever Microsoft employee implemented their security kept doing what the books said n…

http://www.rapid7.com/db/vulnerabilities/windows-rdp-constan... I think the newer RDP versions uses TLS BTW.

I did the reverse engineering on RDP 4, almost 10 years before that vulnerability report. With each RDP release they did very big changes to the security layer as well as other pieces. Somewhat surprisingly Microsoft did base RDP on open standards, especially a whole bunch around video messaging.

But those standards were developed by committee, so the number of ways you could do things was usually the same as the number of committee members. Then their implementation had bugs (eg drawing some parts from bottom to top when the standards said top to bottom), but they didn't know this since they didn't try interoperating with other implementations. The initial "security" was some half assed hack, and yes in later versions they did switch to TLS.

Note that the security is complicated because of domain membership, WAN vs LAN, and a bunch of other related issues.

Post reply on HN