Windows

508 readers

42 users here now

For all things Windows.

founded 4 years ago

MODERATORS

QuentinCallaghan@sopuli.xyz

Windows RDP lets you log in using revoked passwords. Microsoft is OK with that. (arstechnica.com)

submitted 2 days ago by neme@lemm.ee to c/windows@sopuli.xyz

7 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] 18USCode2381@infosec.pub 8 points 2 days ago (1 children)

Ransomware Delivery Protocol at it again.

[–] Onomatopoeia@lemmy.cafe 7 points 2 days ago* (last edited 2 days ago) (1 children)

Sounds like this is nothing more than the native credential token caching NT always had. So even if you lost domain connectivity for months, anyone who had previously logged into that machine could still log in (of course, because it hasn't connected to the domain directory for credential updates).

Not sure why it's seen as an RDP specific thing, I don't see anything in the article clarifying this only affects RDP. It should affect the entire machine/any local logins (not local credentials, any logins that happened on the machine, so the domain credential token was cached).

Some clarification around how credentials are updated from Azure/MS would be helpful, and clarify if this is any more than the original NT token caching.

[–] wizardbeard@lemmy.dbzer0.com 4 points 2 days ago

Thank you. It's annoying that there isn't a separate set of settings for RDP connections specifically, but as far as I can tell this is the standard caching feature controlled/mitigated by the same means as it always has been.