CSI software and Terminal Services

Important information
Using CSI with terminal services
Determine if your system is using terminal services
Potential attacks and recommendations

Important information

This document explains some potential security risks in using CSI with terminal services products. It is not an exhaustive list of all security risks. Please seek advice from a computer security expert before using CSI with your terminal services product.

The Tax Office gives no express or implied warranties (and to the full extent of the law excludes all statutory warranties) in relation to the recommendations in this document (including as to their performance or fitness for a particular purpose), and will not be liable in any way for any loss or damage (including special, indirect or consequential) arising from or in connection with those recommendations or their use or performance.

Using CSI with terminal services

CSI has been designed to operate securely with most popular Internet browsers, and some other applications, when installed and run on a single computer. However, it has not been designed to provide the same levels of security when operating with terminal services products.

Some common terminal services products are Microsoft Terminal Services, Citrix Metaframe, Citrix Presentation Server, Jetro CockpIT, Jetro BoostIT, Tarantella New Moon Canaveral IQ, Virtual Networking Computing (VnC), and DAT Panther server.

Even though CSI may function with a terminal services product, you should carefully consider potential security risks before deciding to use CSI with that product.

Determine if your system is using terminal services

To determine whether your system is using terminal services, download the terminal services tester program. Save the file to your desktop and double click to run.

Potential attacks and recommendations

Honey Pot attacks

Computers running a terminal services product contain the certificate stores for many, perhaps all, of the organisation's users. This creates a 'Honey Pot' where an attacker can gain access to many certificate stores.

The risk is greater if remote connections are enabled, especially if the remote connections use the Internet. In this situation an attacker may be able to access the honey pot from anywhere in the world.

How to reduce Honey Pot attacks

immediate installation of operating system and application security patches
minimising the number of applications on the computer
minimising the number of users who can log into the computer
limiting physical access to the computer
limiting administrative access to the computer to only trusted personnel
automatically recording the computer's activities
frequently reviewing recorded activities to check for inappropriate use, and
installation and active use of firewall, virus checking and malware scanning software.

If remote connections are required you should consider using a Virtual Private Network (VPN), configured so users are authenticated with cryptographic tokens/keys rather than weaker methods e.g. username and password authentication.

Man in the Middle attacks

Man in the middle attacks involve an attacker gaining access to information sent between two computers using impersonation.

The attacker makes the source computer believe they are the destination computer and vice versa. This allows the attacker to access, and change, all the information sent between the two computers without you knowing.

When you use CSI with terminal services an attacker can potentially access and change information you send. The attacker may also gain access to passwords used to restrict access to certificates held within the certificate store.

This gives them the ability to impersonate you and fraudulently conduct business on your behalf.

How to reduce Man in the Middle attacks

To reduce the likelihood of your computer (running the terminal services product) being impersonated by an attacker, consider configuring Secure Sockets Layer (SSL) with at least 1024 bit asymmetric keys and 3DES or AES encryption. This allows your computer to be more securely authenticated by other computers.

Snooping

Snooping is similar to man in the middle attacks; however the attacker does not need to use impersonation. If an attacker can gain access to your computer network, either physically or through the use of applications, they may be able to listen to information as it travels through your network.

When you use CSI with terminal services every image displayed on the computer screen and every key typed on the keyboard (including your password) is sent across the computer network to the computer running the terminal services product. In a similar way to man in the middle attacks this may allow the attacker to access your password and the information you send.

This gives them the ability to impersonate you and fraudulently conduct business on your behalf.

How to reduce snooping threats

You should consider configuring Secure Sockets Layer (SSL) with at least 1024 bit asymmetric keys and 3DES or AES encryption. In this situation, configuring SSL allows information sent to and from the computer running the terminal services product to be encrypted, reducing the risk of an attacker being able to read the information that is sent across the computer network.

Shared access attacks

Many terminal services products allow for a configuration where all users access the computer running the terminal services product with the same user profile. This causes all users to have the same settings and home directory.

When you use CSI with terminal services all users will be able to see and access all certificates. This is due to the certificate store being kept in the home directory.

How to reduce shared access attacks

We recommend configuring your terminal services product so each user has their own private home directory and user profile.