Insights into Encrypted Network Connections: Analyzing Remote Desktop Protocol Traffic

Abstract

An increasing number of network connections are encrypted to protect the confidentiality of the transferred data. Also attackers make greater use of encrypted protocols to hide from detection and to hinder investigations. Currently, most security systems (e.g., Intrusion Detection Systems (IDSs) and firewalls) cannot effectively analyze encrypted traffic. This results in "blind spots", which can put the security of a whole environment at risk. In this paper, we propose a system that is capable of investigating encrypted Remote Desktop Protocol (RDP) connections. In the first step the private RSA key of the RDP server is used to decrypt the TLS/SSL layer of the RDP stream. In the second step our system extracts all relevant information (e.g., keystrokes and transferred files) from the RDP connection. This information makes it possible to reconstruct the behavior and the activities of an attacker with a high accuracy. For the evaluation of our approach we performed a scan of 231,025 internet facing RDP systems and revealed that over 95 % of the RDP connections to these systems can be decrypted with our system.