The T.128 application sharing protocol is a derivation of the RDP (remote desktop protocol), which uses a single TCP/IP port (default 3389) to establish a connection. Without getting into the technicalities of how each packet and frame is built, the important takeaway is that all traffic is generally point-to-point, encrypted, and contains all the data needed to efficiently transmit and process an entire user experience remotely with various fault tolerance, authentication, and even multiple monitor support mechanisms. All of this is accomplished without the need of HDMI, USB, or other forms of cords. In reality, as long as TCP/IP is accessible, it works great across WiFi and even cellular.

The picture above is about illustrates typical networking possibilities. To connect to remote desktop gateways on-premises, a client can utilize a browser or a remote desk client over the Internet. While these are predicated on using RDP via HTTPS (blue and black connecting lines), the danger is only substantially reduced as compared to using RDP directly (orange line). As part of the mitigation, additional authentication and abstraction constraints in the RD Gateway or RD Web Access Server would be established as Policy Rules.

The greatest risk, however, is exposing RDP on the Internet (port 3389) and allowing it to get through firewalls directly to a target on the internal network. This is a widespread practice that should be avoided at all costs. To that end, whether you’re acquainted with Citrix Server or Microsoft Windows Terminal Services, you’re presumably utilizing RDP on a regular basis—and may not even realize it—through a Remote Desktop (RD) Gateway or RD Web Access method, both of which pose comparable hazards.