- Security scientist Daniel Wade discovers worrying Microsoft RDP feature
- This makes it possible to use old credentials when logging in
- Microsoft has confirmed that it has no plans to change this
Security researcher Daniel Wade has discovered a protocol within Microsoft’s Remote Desktop Protocol (RDP), which allows users to log on to machines using recalled passwords.
Wade’s report warns “This is not just a mistake. It’s a breach of trust” that reminds Microsoft that people are changing their passwords that trust that this will “cut off unauthorized access”, making this feature completely modintuitive. Wade warned “millions of users – at home in small businesses or hybrid work – is unconsciously in danger.
Surprisingly, Microsoft said in his answer that this behavior is not a mistake – instead of calling it, “a design decision to ensure that at least one user account always has the ability to log in, no matter how long a system has been offline.”
A feature, not an error
Microsoft confirmed that the question did not meet its definition of a safety vulnerability and that the company has no plans to make changes to this.
According to Wade’s report, there is no clear way for end users to detect or solve the problem at their end, and Azure, Defender, Entra ID does not raise any flags, leaving users vulnerable even if they take protective measures.
“This creates a quiet, remote back door in any system where the password ever became cache. Even if the striker never had access to this system, Windows will still rely on the password,” Wade claims.
Credential stealing and data violations are far too common, and compromised passwords are a serious risk to both businesses and users. Research has shown that security attacks on password managers have increased with attacks that are growing more frequently and sophisticated.
This means that regular password rotation is an important facet of cyber security and best password hygiene practice center that is revoked old, recycled or compromised passwords – making this function all more confusing and concerning.
Via Ars Technica
