credential caching Archives

Winsage

May 2, 2025

CISOs should re-consider using Microsoft RDP due to password flaw, says expert

Microsoft has clarified that a feature in its operating system, which allows at least one user account to log in after prolonged offline periods, is a deliberate design choice and not a security vulnerability. The Remote Desktop Protocol (RDP) caches the last set of credentials used to prevent administrators from being locked out, but this can lead to complications if credentials are changed, potentially allowing unauthorized access if outdated credentials are exploited. Johannes Ullrich from the SANS Institute emphasized the importance of securing RDP and recommended robust authentication measures and isolation of RDP endpoints to mitigate risks.

Winsage

April 30, 2025

Windows RDP lets you log in using revoked passwords. Microsoft is OK with that.

The ability to use a revoked password for Remote Desktop Protocol (RDP) access on Windows machines linked to Microsoft or Azure accounts allows users to log in with either a dedicated password or the credentials from their online account. Even after changing the account password, the old password remains valid for RDP logins indefinitely, and in some cases, multiple previous passwords may still grant access. This behavior poses significant security risks, especially if the account has been compromised, as changing the password does not block access via RDP with the old password. The issue arises from credential caching on the local machine, where the initial login credentials are stored securely, allowing continued access without online verification.