Is Microsoft Remote Desktop secure enough for the Internet?
As with every other Microsoft product, there have been numerous weaknesses found via authenication, timestamping and DoS vulnerabilities. I would recommend you do many things, including restricting access to port 3389 to IP, changing the default port on which RDP runs from 3389 to something else, as well as tunneling the protocol through a VPN, SSH or stunnel.
I second Mr. Six’s advice. Beware, though, that if you change the port from 3389 to something else, you will have to have the full Remote Desktop Connection client installed on a computer in order to connect. This is only really an issue if you’re using the web-based ActiveX version of Remote Desktop. I personally do not “wrap” my RDP sessions, because I don’t have anything of value, and to my knowledge, there are no “rdp sniffers” anywhere out there. There’s some good information about the security of RDP on Experts Exchange regarding this topic. The second “Accepted Answer” pretty well sums it up, IMHO.
