Langa Letter: How To Ensure Remote-Control Security With XP - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

10:50 PM
Fred Langa
Fred Langa

Langa Letter: How To Ensure Remote-Control Security With XP

XP's built-in Remote Desktop, Remote Desktop Web Connection, and Remote Assistance are great tools, Fred Langa says, but only if you carefully manage their security implications.

When we first discussed XP's Remote Control tool in this space, we called it one of that operating system's "hidden gems: A built-in, simple way to control your PC from afar. It lets you do everything from basic file and data access up to fully taking over the keyboard and mouse of a distant PC, just as if you were sitting in front of it. What's more, XP Pro extends this remote-control ability to any and all versions of Windows -- all the way back to Win95, including Windows CE palmtop systems and XP Home -- via a FREE client software tool."

That first article runs through the similarities and differences among the tool's three major faces ("Remote Desktop," "Remote Desktop Web Connection," and "Remote Assistance"). It then shows you the pros and cons of each, shows you where to get the free client software, and most important, shows you how to use these remote-control options safely. If you're not familiar with these Remote Control services, that article would be a great place to start.

A more recent discussion in my newsletter delves further into some of the security implications of these services, and also prompted some excellent reader mail, such as this:

Fred, You mentioned that when connecting via Remote Desktop (Remote Control), the remote connector needs a valid account and a password on your system, and the connection is automatically encrypted. How secure is the connection? I tried (in vain) to set up a VPN to a client's office using a LinkSys Router on their end and SSH Sentinel client software on mine. Couldn't get it to work. But I can easily use Remote Desktop to connect to the machine I use at their office, it works fine. As this client is a CPA with thousands of tax clients, I'm particularly worried about the security of the connection. And, to take the concept one step further, I can also use Remote Desktop to connect to the server at the office (i.e., I Remote to my workstation, then Remote again from that workstation to the Server). That also works fine--but how secure is the connection? I use very strong passwords for both my account and the server admin account.
-- Sal Sorice

How secure is it? Well, there's no absolute measure for things like this, but the fuzzy answer is "adequate in itself, but easy to improve upon." Remote Control's encryption makes any actual data transfer relatively safe, but that's not the real danger. Rather, the more serious risk lies in some unauthorized person connecting to an idle PC with Remote Control enabled. At the least, they'd (obviously) have some access to data and files on that PC itself; and if the remote-controlled PC is on a LAN, then it's possible for the intruder to reach out to other PCs on the LAN, or even the server.

Clearly, you have to be careful with this kind of technology: Anytime you leave a figurative "door" open to the online world, there's obviously more risk than otherwise. But a Remote Controlled system can be made reasonably secure if you use all the available security tools and techniques:

Beefing Up Local Security
First, let's make it a given that any PC used for Remote Control ("RC") will have a good software firewall running (no "hardware only" solutions, such as relying solely on a router or server-level protection; see this for more information). Second, the PC used for RC must have a current, active, and reliable antivirus tool running; and also will have active (e.g., monitoring) and passive (e.g., Registry lockdown) anti-malware protections in place.

There are many such software tools from which to choose, but a good current list might include:

  • A firewall such as those from Sygate or ZoneAlarm
  • Antivirus systems from Symantec Norton , Nod32 , and AVG
  • Anti-malware such as MS AntiSpyware, SpywareBlaster, StartUpMonitor, WinPatrol, AdAware, and Spybot S&D.
  • Next, all unnecessary network-related services should be turned off on the remote-controlled PC, so that any users wishing to connect remotely are channeled through only known, controlled access points. For example, in most situations, you can safely disable "Messenger" services on the LAN; disable network PnP services; disable DCOM; etc. (See this site for free tools to control these services.) This closes several important "back doors" through which an intruder might try to enter.

    By default, Remote Control (RC), when enabled, allows any member of that PC's Administrator's group to connect. Therefore, any PC used for RC must -- must -- have all admin-level accounts secured with very strong passwords; and the passwords should be changed regularly so that any password-related security breach will be self-closing when the passwords expire. (You can get more information on password aging and expiration by searching the XP help file on "password age." A search on the more general phrase "password policy" will bring up additional security-enhancing options for managing passwords on your XP PCs. The Microsoft Knowledgebase also contains additional good information on password aging, such as this .

    Remote Control also can be set up to allow connection from specified non-admin users (right click My Computer/Properties/Remote then click "Select Remote Users..."). And that's actually the better way to use Remote Control: Connect with the lowest-privileged account that will let you accomplish your purpose. This way, even if someone makes an unauthorized connection to the non-admin account, they won't be able to do all that much. But, of course, even these lower-security Remote-Controllable accounts need strong passwords of their own to prevent people from easily breaking in in the first place.

    File Sharing needs to be carefully managed. An admin-level user can decide how much free rein a non-admin user will have in seeing files on a system; it's possible to make each account's files more or less private, so that non-admin users can't simply traverse the folder structure at will, grabbing files from other accounts. For more info, see "How to configure file sharing in Windows XP."

    We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
    1 of 2
    Comment  | 
    Print  | 
    More Insights
    InformationWeek Is Getting an Upgrade!

    Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

    New Storage Trends Promise to Help Enterprises Handle a Data Avalanche
    John Edwards, Technology Journalist & Author,  4/1/2021
    11 Things IT Professionals Wish They Knew Earlier in Their Careers
    Lisa Morgan, Freelance Writer,  4/6/2021
    How to Submit a Column to InformationWeek
    InformationWeek Staff 4/9/2021
    White Papers
    Register for InformationWeek Newsletters
    The State of Cloud Computing - Fall 2020
    The State of Cloud Computing - Fall 2020
    Download this report to compare how cloud usage and spending patterns have changed in 2020, and how respondents think they'll evolve over the next two years.
    Current Issue
    Successful Strategies for Digital Transformation
    Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
    Flash Poll