Can viruses be transferred to another computer when connected via RDP?

Question

Malware

IT departments do not have the ability to monitor the state of home computers in terms of information security. Therefore, I would like to know if viruses can in any way (buffer, local resources) get to employees' work computers from their home ones. And if so, how to deal with it? If they connect to a terminal server, then there are many options and the issue is resolved quickly. But what if they connect to their computers at their workplaces?

Answer 1

RDP does not guarantee protection against viruses. for example, there are warnings when in the connection parameters, it is allowed to map local disk devices. but if you need file sharing - you will have to allow
it in another way - at least there is a threat of infection, with any method of file sharing (flash drive, network, including mapping via RDP),
some special protection is not required - if you have an antivirus, you have nothing to add upd except not to make mistakes

ps extreme protection (joke with a bit of humor):

- не мапить устройства
- не качать файлы
- уволиться
- отключить интернет и сотовые
- уехать жить в тайгу или в горы

pps and about extreme threats:

- 0day может быть найден везде. возможно и в RDP*, даже если заходите без доступа к локальным устройствам. доступ же предусмотрен протоколом, просто запрещен. а крутые зловреды создаются именно для обхода запретов
- все кто более менее интересовался темой ИБ, знакомы с одним из самых показательных случаев - Stuxnet. но если вы работаете там, где есть гостайна, за нее есть кому беспокоится
- если вы самый главный по ИТ/ИБ, в своей конторе, и задаете такой вопрос, думаю, что самая большая угроза, для вашей конторы, это обычные зловреды - майнеры, воры банковских данных, паролей, и тд. но защита от них, требует только повышения вашего общего уровня в ИТ/ИБ. говоря коротко - не делать ляпов, хотя бы выполнять рекомендации МС для администраторов. а их довольно легко искать. удачи
* еще пример экстрима - специалисты по ИБ, продемонстрировали выход в хостовую систему, даже из виртуалки. но не сохранил ссылку, или сохранил далеко, истории чуть не пару лет.. а может и более ))

Answer 2

If you do not take into account that there may be some vulnerabilities in RDP itself, then a user can transmit a virus only by copying some file from his computer to the worker, if the disks are mapped. Theoretically, a virus running on the client's home machine can also copy files. But transferring the file is not enough - it must also be launched remotely. If the malware replaces the standard RDP client, then it will be able to do a lot of things within the user rights on the remote PC. I have not heard of such a variant of viruses, but theoretically - why not.
Normal protection - antivirus on a remote computer and only limited rights + blocking corporate firewall. Forcibly do not map disks and other flash drives. Under such conditions and in a local version, it is quite difficult for a virus to develop its activity.
At the expense of RDP settings on desktop Windows - yes, there are no buttons, but everything is the same in GPO and in local security policies (if AD is not deployed).
I would not let users on my local computers on the network remotely, tk. you get a number of really uncontrolled entry points to the network. The virus may not penetrate there, but the users themselves will be able to take away everything that lies badly.
On mind to allocate a terminal server in DMZ. From it, provide access to the LAN through an additional (not local) closed firewall with access only to the necessary network resources. Users must keep the necessary files in accessible network directories. In the terminal server, leave only secure secure protocols running, set up a full-fledged certificate with its own CA, be sure to enable authorization at the network level.

Answer 3

No.
But with remote access, the user can download infected files and run them himself.

IT departments do not have the ability to monitor the state of home computers in terms of information security.

And there is no such need.
Why monitor the security of home computers? Yes, let there be something.
It is necessary to monitor the security of the working infrastructure - the terminal server or workstation where the user connects.
Proper configuration eliminates the possibility of infection by 99.9%.
Competent configuration means, first of all, setting up user rights - both for accessing files and for launching programs.

Answer 4

Someone puts antiviruses, kaspersky there or doctors
But it's up to you

Answer 5

absolutely nothing. Unless generally to prohibit any transfer of files. But adequate methods to minimize the chances are:
- Access via intranet only, ie. first, it is necessary to connect via vpn
- For each user, the 2nd account with the rights to even launch .exe itd files. (but here again, the human factor, it is worthwhile to thoroughly explain to people what is possible and what is not)
- set the firefall to maximum isolation.
- Use virtual machines with the above mentioned point))
And so it seems that I also heard that there is a special kind of software that monitors suspicious network traffic in network segments, but here xs ... I just heard))

Answer 6

Depending on what viruses and how everything is configured in general, they can, but not always