Anyone can bypass multiOTP code input by reconnection (edit : if user is already LOGGED IN and NOT LOCKED)

[HumMan]

Hi, I have the following environment:

RDP server: Windows 10 64-bit Version 1709 (build 16299.248) multiOTP CredentialProvider 5.1.0.1 installed in c:\multiOTP\ two factor authorization with multiotp is working NLA enabled Edit by multiOTP: User is already LOGGED IN and NOT LOCKED

Client: Windows 10 64-bit Version 1709 (build 16299.248)

Steps to bypass multiOTP code entering:

1. Connect to the RDP session by entering a password only
2. Don't enter password and OTP code
3. Unplug ethernet cable to simulate a connection lost
4. Wait 15-20 seconds to reconnection message popupp
5. Plug ethernet cable back
6. Reconnection success and you don't need to enter anything

Can you reproduce the bypass?

[HumMan]

Same behaviour in multiOTP CredentialProvider 5.1.0.8 Temp workaround is to disable the clients reconnection in group policy: Administrative templates -> Windows components -> Remote desktop services -> Remote desktop session host -> Connections -> Automatic reconnection = Disabled

[multiOTP]

Hello HumMan,

The process to bypass multiOTP supposed that you are ALREADY logged in on your RDP server AND that your session IS NOT LOCKED.

In this case, when you loose the connection, the behavior of NLA is the correct one, as you don't want to have to type your Windows password and a new second authentication OTP in order to reconnect remotely to your computer were you were connected before The Credential Provider is not called during reconnection.

You are right, if you want to strongly secure the client reconnection, you can change that in your group policy, but customer experience will be a little bit more difficult in case of connection loss.

Regards,

Andre

[HumMan]

Hello Andre, thank you for detailed answer. As this is correct behavior of NLA and credential providers (+ there is group policy setting for strong security), then it is not issue.