2

I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely.

For example...

I have two desktops. I use Desktop 1 to remotely operate Desktop 2 through windows' Remote Desktop Connection. Through this connection, I visit a website on Desktop 2. Would it be possible for the website to detect the fact that Desktop 2 is being remotely operated? (Not detect Desktop 1, but just detect remote operation in general).

Anders
  • 64,406
  • 24
  • 178
  • 215
Outcahst
  • 23
  • 1
  • 4

3 Answers3

6

There is no API or simple test a website can perform to know if there is a remote desktop involved. So they easy answer is no.

But I would guess that your mouse movement and maybe also your typing is slightly different when using a remote desktop, due to lag. In the same way that Google reCAPTCHA uses mouse movement and typing data to differentiate humans from bots, it is concievable that you could spot a remote desktop user. But it would require training some sort of AI, and a lot of work, for no clear benefit.

So is it possible? In theory, maybe. Does it happend in practice? No.

Anders
  • 64,406
  • 24
  • 178
  • 215
1

TL;DR: Should be possible.

It was possible to detect Windows Remote Session in the past by using media queries to look for the bit depth of the display (which is switched to an odd value by rdp by default, therefore was easy to detect). Just look for "javascript detect windows remote desktop" on google, and select the StackOverflow answer.

If the method mentioned in that article no longer works (I do not have time to verify), there certainly has other workarounds.

The browsers get more and more integrated with the devices/OS therefore you will get more side channels.

For example it was possible about a year ago to identify every specific iPhone 7 by accessing their gyro calibration values and using that as a fingerprint, doing this by simply opening a website in Safari and using JavaScript.

Sevron
  • 180
  • 8
0

Altought it has been already answered, the right answer is YES, you can!

Bellow is a similar question. Therefore you can use JS to create a tiny div with id='rdp-test' and append it to body. Then you insert a style in document.head which contains #rdp-test { height: 0 }, and immediatedly after this CSS line this one: @media screen and (prefers-reduced-motion: reduce) { #rdp-test{ height: 10px; } }

After these step, in JS, you read the height of the DIV. If it is 10, then the user has RD on, else it has no RD.

After you find out what you need you discard the div and css style.

https://stackoverflow.com/questions/3417883/how-to-detect-from-browser-if-user-is-running-in-remote-desktop-session

besciualex
  • 101
  • 2