On security protocols for desktop sharing

Abstract

In this paper we examine security protocols employed in a number of tools for desktop sharing. These tools allow one user to see and interact with the desktop of another user, i.e. transmitting the contents of one computer's logical display to another place, including user interaction. In contrast to remote sessions, with desktop sharing, the access to the machine is shared, e.g. for interactive user support or for supporting administrators by experts for certain tasks or application programs. A number of these tools use an external communication server as a relay to sidestep problems when both the user and the support agent are behind firewalls. In this paper we identify design flaws in the security protocols employed by a number of such tools, most notably a problem which allows the provider of the communication server to compromise the security of the communication. Further, we examine the certificates of security that some of these tools bear in the light of our findings. Ad- ditionally, we analyse the security requirements for a relayed communication protocol, which seems to be missing so far, and make high-level suggestions for an instantiation.