New Unpatched Bug Could Allow Client-Side Attackers to Bypass #Windows Lock Screen On RDP Sessions

Read more — thehackernews.com/2019/06/rdp-wi…

All the attacker needs to do is… interrupt the network connectivity of a targeted client system and Tadaaaa...! the lock screen will disappear

Starting with Windows 10 1803 and #Windows Server 2019, this flaw exists when login over #RDP requires the clients to authenticate with Network Level Authentication, an option that #Microsoft recently recommended as a workaround against the critical #BlueKeep RDP vulnerability.

Moreover...

"Two-factor authentication systems that integrate with the Windows login screen, such as Duo Security MFA, are also bypassed using this mechanism. Any login banners enforced by an organization will also be bypassed." @wdormann confirmed.

Joe Tammariello, who discovered this issue, notified Microsoft of the #vulnerability on April 19, but the company said the "behavior does not meet the Microsoft Security Servicing Criteria for Windows."

thehackernews.com/2019/06/rdp-wi…

Expect no patch for Lock Screen bypass anytime soon

Client users can protect their RDP sessions against potential exploitation of this vulnerability by simply locking their local system instead of the remote system, or both, while leaving the system unattended and also by disconnecting RDP sessions instead of just locking them.

We have just added a video demonstration for the latest unpatched "Windows Lock Screen bypass on RDP Session" vulnerability (CVE-2019-9510)

Watch >> thehackernews.com/2019/06/rdp-wi…

Video courtesy of @LeandroNVelasco from KPN Security Research Team.