Security

All connections established between a computer and the Automatos Remote Control server are encrypted using the TLS (Transport Layer Security) protocol, the successor to SSL, ensuring that transmitted data remains confidential and integral throughout the entire communication.

Activities performed through Automatos Remote Control can be monitored by tracking the access history to a computer. This detailed report allows you to view which users accessed the computer and at what times, providing full traceability and auditability.

The user has the ability to lock access to their computer at any time. When disabled, the computer becomes inaccessible until further action is taken.

To access a remote computer, you must establish a link between your Automatos Remote Control account and the target machine. Each user has their own digitally signed executable that uniquely identifies their user account. This executable uses digital certificates for mutual authentication between the client and the server, ensuring that only the legitimate owner can initiate a session.

The digital signature of the executable is based on asymmetric cryptography with an RSA 2048/4096-bit key, ensuring code integrity and authenticity of origin. No other Automatos Remote Control user will be able to view or attempt to establish a remote connection if the computer administrator has not installed the customized Automatos Remote Control program.

The procedure for adding a new computer is described in detail in the Set Unattended Access chapter.

Installing Automatos Remote Control on a computer does not automatically grant access to the machine. To enable access, a strong password must first be set. This password is stored as a cryptographic hash in the Local Machine registry. The plain text password is no longer available after its definition, following security best practices.

The hashing algorithm used for password storage is NTLM (NT LAN Manager) or more robust versions such as SHA-256, depending on the operating system configuration. NTLM hashes are generated from the plain text password and stored in the system registry. This method ensures that even in the event of registry compromise, the original password cannot be directly recovered.

After installing Automatos Remote Control and setting the access password, remote access for the specific user is enabled. Whenever the user wants to connect to the remote computer, they must enter the Automatos Remote Control access password for each remote access session they start.

Note: If you enable User Account Password for a remote computer, users connecting to that computer will not need to enter the Automatos Remote Control access password. The remote computer will remain locked, and the remote user will be able to view the screen only.

The remote desktop control session is established through the main Automatos Remote Control module, which enables the creation of an instant remote desktop control session. This session is protected with TLS encryption, utilizing:

• RSA 2048/4096-bit key for the handshake and secure channel establishment
• AES 256-bit session key for symmetric encryption of data during communication

The RSA handshake is responsible for the secure exchange of keys between client and server, ensuring that the AES session key is shared securely. AES-256 encryption is considered the gold standard in the industry and is resistant to brute-force attacks with current technology.

Once the session is established, no other entity can view the encrypted data during communication. The TLS implementation also protects against attacks such as Man-in-the-Middle (MitM) and replay attacks.

When the Automatos Remote Control session is ended, you cannot connect to the same session again, ensuring that each access is unique and secure. This is achieved through the immediate destruction of the AES session key and the secure channel teardown.

Once connected to a remote computer, the user can view the Windows console desktop session running on the computer. It is recommended that the user:

• Set strong passwords for all Windows accounts, using NTLM hashes or Kerberos for authentication
• Disable accounts that are not in use
• Always log off the computer when not present

When accessing the computer remotely, the user will also need to type the Windows account password, adding an extra layer of security based on the operating system itself. This authentication may involve the use of NTLM hashes or Kerberos tickets for credential validation.

Layer	Component	Security Mechanism	Technical Specification
1	Visibility	Unique digitally signed executable	Digital certificate with RSA 2048/4096-bit
2	Access	Strong password stored as hash	NTLM / SHA-256 in Local Machine registry
3	Session	End-to-end encryption	TLS with RSA handshake + AES-256 for data
4	Operating System	Native Windows authentication	NTLM / Kerberos with account passwords

• Use complex passwords with a combination of uppercase and lowercase letters, numbers, and special characters (minimum 12 characters)
• Change passwords periodically (every 90 days)
• Keep the operating system and Automatos Remote Control always updated with the latest security patches
• Regularly monitor access logs to identify suspicious activities
• Enable two-factor authentication (2FA) when available
• Use dedicated service accounts for remote access with the least privileges necessary
• Configure account lockout policies after unsuccessful login attempts to mitigate brute-force attacks

Standard/Algorithm	Key Length	Purpose
TLS 1.2 / 1.3	—	Secure communication protocol
RSA	2048/4096 bits	Asymmetric encryption, digital signatures, handshake
AES	256 bits	Symmetric encryption of session data
SHA-256	256 bits	Cryptographic hashing for password storage
NTLM	—	Windows authentication hash (legacy)
Kerberos	—	Windows network authentication (modern)