7

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote server), is there a real chance that a virus infects the remote server?

Of course, we protect our local PCs as good as we can, so I'd just like to know if it makes sense to have a policy to restrict file transmissions to FTP or WebDAV and prohibit shares.

I believe a question like this should have been asked before, but I couldn't really find anything.

2
  • It's possible, yes, but plausible is another story altogether.
    – gravyface
    Oct 11, 2011 at 12:07
  • @gravyface: thanks - but can we look into that "other story" a bit deeper? I'd love to get a solid gut feeling if we need to close that possibility or not.
    – Olaf
    Oct 11, 2011 at 12:18

3 Answers 3

3

There's no automated mechanism where a virus would spread through the shared local drives. Unless you count users as Automated Tools of Destruction™ (which I would not underestimate).

We block such access for a couple reasons:

  • Users have a nasty habit of exploiting any superfluous features we allow for their personal enjoyment (and/or accidentally), usually leading to me cleaning up some sort of mess (like that 90+GB of home pictures someone accidentally copied). It doesn't have to be a virus to bring the server to it's knees.
  • We can worry less about what the users are copying off our network. You might not be in the same position we are, but we have financial and personal data laying around everywhere. Most users have access to it. We want to limit their copying of that data to external places to mechanism that are logged and generally easy to trace.
  • There's basically no use case for that access in the first place. We already have a file transfer website, easier and more reliable than copying files in a RDP session. I've only ever had one user ask about transferring files, and one other user ask about printing (which is also disabled by policy).
1
  • 2
    +1 for the "Automated Tools of Destruction" that actually made me LOL Oct 11, 2011 at 14:31
3

YES, INDEED.

Allowing disks to be mapped through a RDP connection is almost as insecure as letting someone go to your server and plug a unknown USB stick in it. There is no extra layer of security here. Users would of course have to open up the dangerous files, like any other virus infection.

The options are simple:

  • Don't allow disk mappings (use sharepoint in combination with UAG or similar instead)

or

  • Secure your server(s) (with antivirus, anti-spyware etc, wich you should do anyways)

Firewalls doesnt help anything, as the RDP session is already encrypted.

2
  • 1
    To clarify; map the drive/share, you can have malware copied to the server. Executing it is a second (and separate) step. So unless your users are being malicious or are being targeted for exploiting your network, having only RDP access is relatively safe. Oct 11, 2011 at 14:13
  • 1
    Automated attacks (copy and execute) would normally require taking advantage of an exploit. I'd be more worried about your users web browsing from the RDP session and infecting themselves with malware. Oct 11, 2011 at 14:14
-1

Yes, if you run programs from your shared disk. Autorun don't work (with default settings).

2
  • 1
    Ok, but that would be a rather unlikely scenario. I was rather thinking about an automatic infection.
    – Olaf
    Oct 11, 2011 at 12:31
  • It is more probable that the user will run an infected program from a shared disk rather than a virus with RDP "skills" to reach your server.
    – migabi
    Oct 11, 2011 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .