The threat landscape
Remote-desktop tools are high-value targets for attackers. Whoever takes over a remote session has:
- Access to everything the logged-in user at the host can see + do
- The ability to install malware
- The ability to move laterally through the network
The most common attacks in 2025/2026:
- Credential stuffing on the tool vendor’s web portal
- Phishing for the session ID + PIN (often via tech-support scam)
- Token theft on a compromised device
- Man-in-the-middle with weak TLS configuration
Seven layers a good tool must have
1. End-to-end encryption per session
Every session gets an ephemeral AES-256 key via ECDH (Curve25519). The key is discarded after the session. Even the tool vendor cannot decrypt sessions after the fact, even under coercion.
2. Hardware-bound device tokens
The token that authenticates the device with the vendor should be encrypted in hardware:
- Windows: TPM 2.0
- macOS Apple Silicon: Secure Enclave
- Linux: TPM 2.0 + tpm2-tools
A stolen token file on another machine is then useless.
3. Multi-factor authentication for account logins
TOTP (authenticator app) or passkey (FIDO2/WebAuthn) should be mandatory for admin roles, recommended for all. No password-only.
4. Fresh authentication for sensitive actions
Revoke a device, change a role, cancel a subscription → re-confirm password or passkey with a short freshness window (e.g. 10 min). Prevents a hijacked session from silently taking these actions.
5. Audit trail by default
Immutable record of connections, file transfers and permission changes. Filter by user + period. On suspected incident: forensically traceable.
6. Anti-tech-scam indicators
A banner at the host device that visualises: “Active connection with [name].” Plus a way to disconnect with one click. Prevents the end user from “forgetting” the session while the attacker keeps the connection in the background.
7. Rate limiting on the session ID
On brute-force against session ID + PIN: after X failed attempts the ID is invalidated, a new session must be generated. Prevents attackers from cycling through the 6-digit PIN.
Practical setup checklist for IT providers
□ Pro plan signed up (audit trail enabled)
□ Admin role: 2FA mandatory (passkey preferred)
□ Supporter roles: 2FA recommended, login notification by email
□ Read-only role for juniors without intervention rights
□ Hardware token enabled on every host
□ Session history reviewed weekly (anomalies?)
□ Webhook integration into ticket system (correlate session ↔ ticket)
□ Standard DPA signed with every customer
□ Emergency procedure documented: token compromised → revoke → new
□ Backup MFA method configured (recovery codes physical + secure)What to look for in a tool vendor
- Can the vendor see the keys? End-to-end = no.
- Where are the servers? Ideal: Switzerland/EU.
- Which compliance certifications? Audit is a plus, ISO 27001 ideal.
- How does incremental improvement work? Bug bounty? CVE disclosure policy? Security advisories?
- What happens if the vendor goes bankrupt? Can you keep accessing, or do data disappear?
Concretely with WinDesk
- AES-256-GCM + ECDH Curve25519 per session
- TPM/Secure Enclave-bound tokens (Windows + macOS + Linux)
- 2FA mandatory for admin, passkey support for all
- Sensitive actions: 10-min freshness re-auth
- Audit trail by default, CSV export
- Anti-scam: tray icon + start toast + connection banner at host
- External security audit planned for Q4 2026
- Bug reports to security@windesk.ch; honest CVE disclosure