Virtual desktop environments have security limitations that can be exploited by attackers. A presentation demonstrated how a virtual "rubber ducky" USB device could be used to inject keystrokes and scripts into a virtual desktop to steal data or take control of the system despite security measures like multifactor authentication. While virtual desktops offer benefits like centralized management, the architecture makes it difficult to fully secure them since all input, output, and processing occurs remotely on a shared server instead of an isolated physical endpoint. Presenters concluded that although virtual desktops have valid use cases, security should not be considered an advantage since fundamental limitations leave these environments vulnerable to sophisticated attackers.
1 of 45
Downloaded 22 times
More Related Content
Virtual Datacenter Infection: Attacking VDI from the Endpoint
44. Implementation Challenges
PCoIP input issues
Drops/reorders keystrokes
Key repeat issues
Happens even with fast typing
VMware: no accessibility support
QR code not optimized for screenshots
RDP sound cuts out too much for modem
7/20/2014
45. Conclusions
1. There is no defense against a sophisticated,
malicious user.
1. There are fundamental architectural
limitations to hosted desktops.
1. There are some good reasons to do VDI.
Security is not one of them.