Real VNC Security Questions

2007-02-06 Thread steve f
I have a need to set up a remote connect methodology to allow support folks here at our headquarters to shadow and potentially guide remote users through our applications from time to time. I would be connecting to a SuSE8 device across a WAN ( over 600 probable remote locations) and am intere

Re: vnc security flaw?

2006-06-08 Thread Jaroslaw Rafa
Alex Pelts napisal(a): > I can tell you exactly how this is different, but first I want to thank Because of top-quoting is it unclear WHAT is different... After scrolling down the entire message I find out that it refers to my previous posting: > > What is different in running a VNC server expose

Re: vnc security flaw?

2006-06-08 Thread Alex Pelts
I can tell you exactly how this is different, but first I want to thank Mike Miller who pointed out that you need to disable vnc connection from hosts other than local host. I skipped that part as being an obvious one but it probably is not that obvious. The difference of running ssh vs running p

Re: vnc security flaw?

2006-06-07 Thread Jaroslaw Rafa
[__ __] napisal(a): [Charset ISO-8859-1 unsupported, filtering to ASCII...] > Dave Dyer wrote: > > Why do you think it will never happen? I think it's inevitable. > > I pay for virus protection; there's real money to be made providing > > a better service. > > I don't think you can, by any

Re: Re: vnc security flaw?

2006-06-07 Thread glendaharris
learn as much as I can to minimize any security threats. Thanks everyone. Glenda Harris > > From: Hal Vaughan <[EMAIL PROTECTED]> > Date: 2006/06/06 Tue PM 02:13:51 EDT > To: vnc-list@realvnc.com > Subject: Re: vnc security flaw? > > On Tuesday 06 June 2006 13:15, Dave

Re: vnc security flaw?

2006-06-07 Thread ·· ħþø ··
Jaroslaw Rafa wrote: Why? What is different in running a VNC server exposed to the Internet from running a SSH (or even a telnet!) server exposed to the Internet, for example? And there are many such servers out there... It's like any remote access service - you run it, if you need it. Of course,

Re: vnc security flaw?

2006-06-07 Thread Hal Vaughan
On Tuesday 06 June 2006 16:40, Dave Dyer wrote: > >> 2) word should have been passed to norton, mcaffee, etc so they > >> could target vulnerable versions of vnc on behalf of their > >> customers. I don't know if this mechanism exists, but it ought to. > > > >This one is never going to happen for c

Re: vnc security flaw?

2006-06-07 Thread Mike Miller
On Tue, 6 Jun 2006, Alex Pelts wrote: IMHO, VNC people did all they could to fix the problem and post the update. It is up to the users to make sure they are up to date. If you do not like RealVNC security record you are always free to run any other software. There are really many choices you ca

Re: vnc security flaw?

2006-06-07 Thread virus
John Aldrich wrote: [EMAIL PROTECTED] wrote on Tuesday, June 06, 2006 5:11 PM: Probably the way to protect people from doing stupid things is to electrocute them any time they are clicking on attachment to develop a reflex. (BOFH Mode=ON) Hmm... I *like* that idea. (BOFH Mode=OFF) see http:

RE: vnc security flaw?

2006-06-07 Thread John Aldrich
[EMAIL PROTECTED] wrote on Tuesday, June 06, 2006 5:11 PM: > > It is simply impossible to protect a person from himself. >[snip] > > Probably the way to protect people from doing stupid > things is to electrocute them any time they are clicking > on attachment to develop a reflex. > (BOFH Mode=O

Re: vnc security flaw?

2006-06-07 Thread ·· ħþø ··
Alex Pelts wrote: It is simply impossible to protect a person from himself. At this time pretty much anyone should know that clicking on attachments is bad yet everyone still does it. With amount of scams going on you wold thing that people would be suspicions of emails asking them to type in the

Re: vnc security flaw?

2006-06-07 Thread Alex Pelts
Well, Let say if you pay money to Symantec why don't you ask them to protect your pc? What is RealVNC has to do with it? I pay money to RealVNC people for EE and I got my email notifying me about security update. So I have no beef with RealVNC as they provide the service I pay for. I think 2) wil

Re: vnc security flaw?

2006-06-07 Thread Alex Pelts
> I don't think you can, by any means, compare your proposition to an > antivirus solution. The complexities of protecting a person from > protecting their own ignorance, not in a demeaning sense, are so > multifaceted. It would literally be impossible to stay on top of every > single threat, and t

Re: vnc security flaw?

2006-06-07 Thread ·· ħþø ··
Dave Dyer wrote: Why do you think it will never happen? I think it's inevitable. I pay for virus protection; there's real money to be made providing a better service. I don't think you can, by any means, compare your proposition to an antivirus solution. The complexities of protecting a pers

Re: vnc security flaw?

2006-06-07 Thread Dave Dyer
>> 2) word should have been passed to norton, mcaffee, etc so they >> could target vulnerable versions of vnc on behalf of their customers. >> I don't know if this mechanism exists, but it ought to. > >This one is never going to happen for countless reasons. No company will >make your box secure if

Re: vnc security flaw?

2006-06-07 Thread ·· ħþø ··
Dave Dyer wrote: It's really not realistic or reasonable to expect every PC user to be their own ever-vigilant security expert. I try to keep up on these things, and I had barely noticed. I doubt that 10% of VNC users read either slashdot or vnc-list, much less never miss anything important t

Re: vnc security flaw?

2006-06-07 Thread Jaroslaw Rafa
Alex Pelts napisal(a): [Charset iso-8859-1 unsupported, filtering to ASCII...] > > IMHO running VNC server exposed to the Internet is a bad idea in the > first place. Why? What is different in running a VNC server exposed to the Internet from running a SSH (or even a telnet!) server exposed to th

Re: vnc security flaw?

2006-06-07 Thread Alex Pelts
Dave Dyer wrote: > 1) vnc should maintain it's own list, reserved for security flash > alerts only, and strongly encourage anyone who installs vnc > to sign up. That is not such a bad idea but this security problem only happened once since I started using VNC(as far as I recall), and I started usi

Re: vnc security flaw?

2006-06-07 Thread Hal Vaughan
On Tuesday 06 June 2006 13:15, Dave Dyer wrote: > It's really not realistic or reasonable to expect every PC user to be > their own ever-vigilant security expert. Yes and no. It depends on how important security is to you. As pointed out, the flaw was posted on this list. I find that just re

Re: vnc security flaw?

2006-06-07 Thread cpz
Hi guys, I just had that experience. However, I have Zone Alarm installed so when the intruder tried to download the trojan file, my Zone Alarm blocked it. Still, the intruder caused certain programs not to function correctly but I could just re install them. I signed up

Re: vnc security flaw?

2006-06-06 Thread Dave Dyer
It's really not realistic or reasonable to expect every PC user to be their own ever-vigilant security expert. I try to keep up on these things, and I had barely noticed. I doubt that 10% of VNC users read either slashdot or vnc-list, much less never miss anything important there. Two things t

Re: vnc security flaw?

2006-06-06 Thread Alex Pelts
Dave, The fix was posted next day after the flaw was discovered. At that time there was no exploits or they were not prevalent. I am not so sure what VNC team could do to better inform people. Discovery of flaw was published on slashdot and this list. I am not trying to tell that this is your fault

Re: vnc security flaw?

2006-06-06 Thread Dave Dyer
>Both of you need to keep up on your software -- a new version was recently >released to solve severe security flaw in the v4.x line. The trojans you got >obviously exploited this flaw. I can't argue with that, but this security flaw and the need for updating didn't get a lot of airplay. I'm ju

Re: vnc security flaw?

2006-06-06 Thread ·· ħþø ··
2006 3:37 PM Subject: Re: vnc security flaw? Last night, while inactive and unattended, my machine picked up a trojan of the "firefly" family of remote control trojans. http://www.sophos.com/virusinfo/analyses/trojfireflyb.html Since the trojan's init file contained my vnc serve

Re: vnc security flaw?

2006-06-06 Thread Darkman
today after updating norton and found one trojan and one or two other website deposited remote access files anyone ever see conneciton instances in their event logs? - Original Message - From: "Dave Dyer" <[EMAIL PROTECTED]> To: Sent: Monday, June 05, 2006 3:3

Re: vnc security flaw?

2006-06-06 Thread Dave Dyer
Last night, while inactive and unattended, my machine picked up a trojan of the "firefly" family of remote control trojans. http://www.sophos.com/virusinfo/analyses/trojfireflyb.html Since the trojan's init file contained my vnc server password, I suspect that vnc was somehow related to the event

Re: VNC security patches

2006-05-15 Thread Rex Dieter
James Weatherall wrote: Some important security patches have been made to VNC server software. We strongly recommend that users of VNC 4 series servers upgrade as soon as possible. http://www.realvnc.com/upgrade.html Where's the source? Coming soon I hope? (: -- Rex ___

VNC security patches

2006-05-15 Thread James Weatherall
Some important security patches have been made to VNC server software. We strongly recommend that users of VNC 4 series servers upgrade as soon as possible. http://www.realvnc.com/upgrade.html -- The VNC team ___ VNC-List mailing list VNC-List@realvnc

Re: vnc security

2006-05-11 Thread Alex Pelts
'-Paul'" <[EMAIL PROTECTED]>; Sent: Tuesday, May 09, 2006 1:00 PM Subject: RE: vnc security -Paul wrote on : When I loaded the realvnc onto my WinME computer I got an additional warning about security that I didn't get on my WinXP computers. Something about the passwords

Re: vnc security

2006-05-11 Thread Eric
Is there a good FAQ or HOWTO on ssh with vnc? what is the url Thanks - Original Message - From: "John Aldrich" <[EMAIL PROTECTED]> To: "'-Paul'" <[EMAIL PROTECTED]>; Sent: Tuesday, May 09, 2006 1:00 PM Subject: RE: vnc security > -Paul wr

RE: vnc security

2006-05-10 Thread James Weatherall
ED] > [mailto:[EMAIL PROTECTED] On Behalf Of -Paul > Sent: 09 May 2006 20:09 > To: John Aldrich > Cc: vnc-list@realvnc.com > Subject: Re: vnc security > > John Aldrich wrote: > > > That being said, what the warning is really saying is that, > theoretically, >

Re: vnc security

2006-05-09 Thread -Paul
John Aldrich wrote: That being said, what the warning is really saying is that, theoretically, someone could decrypt the password if they had access to the local console. On the other hand, if they've got access to the local console, you've got more important security problems than someone being

RE: vnc security

2006-05-09 Thread John Aldrich
-Paul wrote on : > When I loaded the realvnc onto my WinME computer I got an > additional warning about security that I didn't get on > my WinXP computers. Something about the passwords not > being secure? > > A potential intruder would still have to type my password > correctly to gain entry th

vnc security

2006-05-09 Thread -Paul
When I loaded the realvnc onto my WinME computer I got an additional warning about security that I didn't get on my WinXP computers. Something about the passwords not being secure? A potential intruder would still have to type my password correctly to gain entry thru the 5902 port (the port I use

Re: VNC Security and Privacy

2005-08-30 Thread Angelo Sarto
You can have view only clients (e.g. a demo) or possibly someone is just showing you something but you may have left your password stored in the clipboard. (not that i store my passwords somewhere where I can cut and paste them ;) --Angelo On 8/30/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:

VNC Security and Privacy

2005-08-30 Thread geoff
I hope this does not get mailed more than once, had a wee problem with my registered address. I am curious, the documentaion from the VNC page has the following; Send clipboard updates to clients SendCutText=true/false This option, if unticked, prevents the VNC Server from informing clients of

RE: VNC security

2005-08-17 Thread James Weatherall
Bernard, > Alternatively it's possible to configure VNC to only accept > connections > from localhost. This requires a VPN to be set up between the > remote and > local machines. That can use any type of encryption your IT > guys think > is required. Even if the blackhats sniff the network t

RE: VNC security

2005-08-17 Thread James Weatherall
Bernard et al, > >specific users is a secure activity, but our IT guys are now > saying that > >it doesn't necessarily protect our systems from worms or viruses that > >may already inhabit the trusted user's computers. > > That's correct, in that if there was a weakness in VNC it could be > exp

RE: VNC security

2005-08-17 Thread James Weatherall
PROTECTED] On Behalf Of mbrown > Sent: 16 August 2005 20:04 > To: vnc-list@realvnc.com > Subject: VNC security > > We are behind a firewall, but want to get VNC to allow consultants we > trust to have remote access to our computers (and vice versa). Past > posts to this list co

Re: VNC security

2005-08-17 Thread Bernard Peek
In message <[EMAIL PROTECTED]>, mbrown <[EMAIL PROTECTED]> writes We are behind a firewall, but want to get VNC to allow consultants we trust to have remote access to our computers (and vice versa). Past posts to this list convinced me that opening a port in the firewall for specific users is a

Re: VNC security

2005-08-16 Thread Scott C. Best
Mike: Heya; fortunately, your IT guys are wrong about this. VNC is simply a "remote desktop" application, not a "Virtual Private Network" application. Unlike the latter (in which a remote PC does "traverse your firewall" and effectively becomes part of the LAN), a "remote desktop" connect

VNC security

2005-08-16 Thread mbrown
We are behind a firewall, but want to get VNC to allow consultants we trust to have remote access to our computers (and vice versa). Past posts to this list convinced me that opening a port in the firewall for specific users is a secure activity, but our IT guys are now saying that it doesn't nece

RE: VNC Security

2005-06-28 Thread Steve Bostedor
A while back, we had a pretty long running and informative thread on VNC security. The only VNC that had real encryption built in was the Enterprise version of RealVNC. UltraVNC had a DSM plug-in but it was pretty nasty to get working and was suffering from compatibility problems. On top of

RE: VNC security, and can free VNC connect to paid VNC?

2005-05-27 Thread Mike Miller
On Fri, 27 May 2005, Erik Soderquist wrote: To be clear, the VNC viewer that uses encryption is free, but but you cannot use the older viewer. not according to realvnc's web page: http://www.realvnc.com/products/features.html according to that, the free one does not include encryption I do

RE: VNC security, and can free VNC connect to paid VNC?

2005-05-27 Thread Erik Soderquist
---snip--- > To be clear, the VNC viewer that uses encryption is free, but > but you cannot use the older viewer. not according to realvnc's web page: http://www.realvnc.com/products/features.html according to that, the free one does not include encryption > To answer the other question, "yes

RE: VNC security, and can free VNC connect to paid VNC?

2005-05-27 Thread James Weatherall
Mike, > Question: If we buy the VNC version that is advertised as > more secure, > will it really be more secure? Yes. Wez @ RealVNC Ltd. ___ VNC-List mailing list VNC-List@realvnc.com To remove yourself from the list visit: http://www.realvnc.com/ma

RE: VNC security, and can free VNC connect to paid VNC?

2005-05-26 Thread Mike Miller
We've used the free VNC for awhile to view machines outside our office, but our IT guys are too nervous about punching through our firewall to allow others to view our machines. I think they're too cautious. Question: If we buy the VNC version that is advertised as more secure, will it reall

RE: VNC security, and can free VNC connect to paid VNC?

2005-05-26 Thread Erik Soderquist
lf Of mbrown Sent: Thursday, May 26, 2005 12:21 To: vnc-list@realvnc.com Subject: VNC security, and can free VNC connect to paid VNC? We've used the free VNC for awhile to view machines outside our office, but our IT guys are too nervous about punching through our firewall to allow others to view ou

VNC security, and can free VNC connect to paid VNC?

2005-05-26 Thread mbrown
We've used the free VNC for awhile to view machines outside our office, but our IT guys are too nervous about punching through our firewall to allow others to view our machines. I think they're too cautious. Question: If we buy the VNC version that is advertised as more secure, will it really be

RE: VNC Security

2005-05-02 Thread Erik Soderquist
asics@securityfocus.com; VNC List Subject: Re: VNC Security First--I believe we're talking apples and oranges. VNC is not an appropriate solution for a true corporate network unless a firewall and a secure link is available (and even then is dodgy). My scenario is this: a. Random user in cyberspace has

RE: VNC Security

2005-05-02 Thread Erik Soderquist
] On Behalf Of Steve Bostedor Sent: Tuesday, April 19, 2005 20:57 To: [EMAIL PROTECTED] Cc: security-basics@securityfocus.com; vnc-list@realvnc.com Subject: RE: VNC Security Thank you for the reply, Alexander. I understand exactly what you're trying to say. I'm not sure if you fully unders

Re: VNC Security

2005-04-26 Thread Andy Bruce - softwareAB
---BEGIN CUT--- In all of these scenarios, you do the setup before hand. All of these scenarios are easily installed, and configured as a tech, and are as simple as 1-3 clicks for a user, no config, because everything (ssh keys, vpn preshared keys, etc) are all saved and stored in advance. A momen

Re: VNC Security

2005-04-26 Thread Andy Bruce - softwareAB
Beat that horse... ---CUT--- Scenario C is assuming the following points. 1. A single remote user with a software firewall, who doesn't belong to a larger corporation, a one person organization. You're supporting them as a contractor. At your location, setup a SSH server available on the internet

Re: VNC Security

2005-04-25 Thread Mike Miller
On Mon, 25 Apr 2005, Mike Miller wrote: If you were using Windows he could start up another VNC desktop that you might not notice... Sorry -- I meant to say "if you were using UNIX". I assume this would not be possible in Windows. Mike ___ VNC-List ma

Re: VNC Security

2005-04-25 Thread Andy Bruce - softwareAB
First--I believe we're talking apples and oranges. VNC is not an appropriate solution for a true corporate network unless a firewall and a secure link is available (and even then is dodgy). My scenario is this: a. Random user in cyberspace has a problem. b. User installs VNC under direction of

Re: VNC Security

2005-04-25 Thread Mike Miller
On Tue, 19 Apr 2005, Andy Bruce - softwareAB wrote: I have to agree with Steve that this is, for all practical purposes, a non-existent security risk. The only things that could go wrong: a. "Somebody" is sniffing the packet stream while the VNC passwords are being exchanged, and, during that 20

Re: VNC Security

2005-04-20 Thread Sean Kamath
[In a message on Tue, 19 Apr 2005 21:14:50 EDT, "Steve Bostedor" wrote:] >I am wondering why expose VNC over the internet in the first place, really. Exactly what I said. VNC should *NOT* be exposed to the internet. >It's my opinion that VNC is really only good for LAN's. Why not use VPN to s

RE: VNC Security

2005-04-20 Thread Steve Bostedor
rom: Joshua Berry [mailto:[EMAIL PROTECTED] > Sent: Wednesday, April 20, 2005 9:41 AM > To: Steve Bostedor; Andy Bruce - softwareAB > Cc: security-basics@securityfocus.com; vnc-list@realvnc.com > Subject: RE: VNC Security > > > Just because some people and applications perfo

RE: VNC Security

2005-04-19 Thread Steve Bostedor
Kamath Sent: Tuesday, April 19, 2005 4:45 PM To: William Hooper Cc: vnc-list@realvnc.com Subject: Re: VNC Security [In a message on Tue, 19 Apr 2005 10:53:09 EDT, "William Hooper" wrote:] >Steve Bostedor wrote: >[snip] >> I've scoured the web out of this curiosit

RE: VNC Security

2005-04-19 Thread Steve Bostedor
l Message- From: Bart Crijns [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 19, 2005 5:15 PM To: Andy Bruce - softwareAB Cc: Steve Bostedor; security-basics@securityfocus.com; vnc-list@realvnc.com Subject: Re: VNC Security Andy Bruce - softwareAB wrote: > 5. Tell them to turn off port forward

RE: VNC Security

2005-04-19 Thread Steve Bostedor
r explains my question further. -Original Message- From: Joshua Berry [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 19, 2005 6:43 PM To: Andy Bruce - softwareAB; Steve Bostedor Cc: security-basics@securityfocus.com; vnc-list@realvnc.com Subject: RE: VNC Security To the original poster: It

RE: VNC Security

2005-04-19 Thread Steve Bostedor
company other ways that do not involve VNC? - Steve -Original Message- From: Alexander Bolante [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 19, 2005 6:25 PM To: Steve Bostedor Cc: security-basics@securityfocus.com; vnc-list@realvnc.com Subject: Re: VNC Security IMHO NOTE: For obvious r

Re: VNC Security

2005-04-19 Thread Sean Kamath
[In a message on Tue, 19 Apr 2005 10:53:09 EDT, "William Hooper" wrote:] >Steve Bostedor wrote: >[snip] >> I've scoured the web out of this curiosity, looking for a tool to >> put VNC packets together into something useful for a hacker. There's >> nothing. Nada. > >Fifth hit on Google for: vnc c

Re: VNC Security

2005-04-19 Thread William Hooper
Steve Bostedor wrote: [snip] > I've scoured the web out of this curiosity, looking for a tool to > put VNC packets together into something useful for a hacker. There's > nothing. Nada. Fifth hit on Google for: vnc capture playback http://users.tpg.com.au/bdgcvb/chaosreader.html -- William Hoop

Re: VNC Security

2005-04-19 Thread Andy Bruce - softwareAB
nternet (port forwarding has the same problem as direct connect) a port sniffer detects that 5900 is available and immediately zooms in thru some VNC security hole. Wez would know a lot more about this possibility than me, though! Am I missing something here? Steve Bostedor wrote: I'd like to k

VNC Security

2005-04-19 Thread Steve Bostedor
I'd like to know if anyone has any working examples of why an unencrypted VNC session over the Internet is seen as such a horrible security risk. I understand that unencrypted ANYTHING over the Internet lends the chance for someone to decode the packets (assuming that they capture every one of the

RE: VNC Security - another question

2004-07-25 Thread Richard Pickett
> 1) Other network vulnerablities assuming the only > protocol I am allowing in is for VNC- are there any? OK, so you're stopping all the traffic coming across the vpn to you except vnc. That way they can't do anything else on your network except vnc. Then by using vnc they have full control of

VNC Security - another question

2004-07-24 Thread Scott Chapin
Hello - There is a request to allow an external company to vnc to a box on our network behind a firewall. In order to do this, I will setup a VPN to protect all traffic traversing the Internet. My question is this. Now that all of the traffic is encrypted, are there other vulnerabilities that I

RE: VNC security implications

2004-07-21 Thread James Weatherall
; From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Alan Watchorn > Sent: 20 July 2004 18:49 > To: [EMAIL PROTECTED] > Cc: VNC List > Subject: RE: VNC security implications > > In a case like this I assume you are using static addresses > for both computers (o

RE: VNC security implications

2004-07-20 Thread Alan Watchorn
ng to decrypt it first. Alan Watchorn [EMAIL PROTECTED] (760) 692-4300 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dave Ho Sent: Tuesday, July 20, 2004 12:40 AM To: [EMAIL PROTECTED] Subject: VNC security implications Hi Folks, I am a bit green when it

RE: VNC security implications

2004-07-20 Thread James Weatherall
ve Homan [mailto:[EMAIL PROTECTED] > Sent: 20 July 2004 10:48 > To: 'James Weatherall' > Subject: RE: VNC security implications > > Hi James, Thanks for the quick reply. I have the two PCs > interconnected via an ADSL Router which has a firewall. So > they are d

RE: VNC security implications

2004-07-20 Thread James Weatherall
to:[EMAIL PROTECTED] On Behalf Of Dave Ho > Sent: 20 July 2004 08:40 > To: [EMAIL PROTECTED] > Subject: VNC security implications > > Hi Folks, I am a bit green when it comes to setting up remote > connections to distant PCs. What I was about to try to do > was to connect from a P

Re: VNC security implications

2004-07-20 Thread Jerome R. Westrick
On Tue, 2004-07-20 at 09:39, Dave Ho wrote: > Hi Folks, I am a bit green when it comes to setting up remote > connections to distant PCs. What I was about to try to do was to > connect from a PC running WinXP to one running Win98 (both are > connected to the internet). I then had a word with the b

VNC security implications

2004-07-20 Thread Dave Ho
Hi Folks, I am a bit green when it comes to setting up remote connections to distant PCs. What I was about to try to do was to connect from a PC running WinXP to one running Win98 (both are connected to the internet). I then had a word with the barman in my local pub (who is an ex PCguru) who said

Re: VNC Security - Windows registry

2004-06-29 Thread Richard Harris
> I would like to see a better encryption process for VNC, as I have had a hacker figure out my password schema Besides encrypting the data stream between host and client there is still (IMO) an issue with WinVNC and storing the encrypted password in the registry. RealVNC 4 stores it's settings in

RE: VNC Security

2004-06-28 Thread James Weatherall
ction". You can find the VNC documentation at http://www.realvnc.com/documentation.html Wez @ RealVNC Ltd. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > [EMAIL PROTECTED] > Sent: 28 June 2004 01:39 > To: [EMAIL PROTECTED]

RE: VNC Security

2004-06-27 Thread John Ellingsworth
://mail.med.upenn.edu/~jellings/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Sunday, June 27, 2004 3:00 PM To: [EMAIL PROTECTED] Subject: VNC Security Dear Sirs: I would like to see a better encryption process for VNC, as I have had a hacker

Re: VNC Security

2004-06-27 Thread myron_in_da_house
Would be better if the lock-out policy was implemented like Windows server does. You have so many attempts then the account get's locked out for the nominated duration, but there is also a counter of attempts that only gets zeroed after another set duration. At 00:30 28/06/2004, William Hoope

Re: VNC Security

2004-06-27 Thread William Hooper
[EMAIL PROTECTED] said: [snip] > > Should be configurable. For instance, two bad password attempts and VNC > server will then give a bad password response even if the password is > correct, but then you have to leave VNC server alone for, say 3 minutes, > before the lock out is release and anothe

Re: VNC Security

2004-06-27 Thread myron_in_da_house
If you're using Windows, let alone any server. Consider using a Virtual Private network and a VPN appliance. Actually, you have to be crazy to let VNC server be visible on the Internet. For the company I work for, and manage their I.T. systems, I firstly establish a connection by VPN using a

Re: VNC Security

2004-06-27 Thread Jerome R. Westrick
Use SSH... On Sun, 2004-06-27 at 21:33, William Hooper wrote: > Jon Lucas said: > > Dear Sirs: > > > > > > I would like to see a better encryption process for VNC, as I have had a > > hacker figure out my password schema, and actually caught him in a > > session of hijacking our server. > > If

Re: VNC Security

2004-06-27 Thread William Hooper
Jon Lucas said: > Dear Sirs: > > > I would like to see a better encryption process for VNC, as I have had a > hacker figure out my password schema, and actually caught him in a > session of hijacking our server. If someone has your password, what would better encryption get you? -- William Hoo

VNC Security

2004-06-27 Thread Jon Lucas
Dear Sirs: I would like to see a better encryption process for VNC, as I have had a hacker figure out my password schema, and actually caught him in a session of hijacking our server. Since then, I have tightened the firewall to only accept specific IPAddresses on 5800 and 5900, but that also

Re: VNC security

2003-09-18 Thread Michael Herman
On Wed, Sep 17, 2003 at 01:09:02AM +0200, Bjvrn Persson wrote: Mike Miller wrote: But it might not be a matter of time because it's so much work for so little gain? How little gain exactly? Your company's trade secrets? The administrator passwords to all your servers? All the money in your bank ac

Re: VNC security

2003-09-17 Thread Scott C. Best
Bjorn: Heya. Some comments to your comments: > If I wanted to sniff other people's VNC traffic i'd first try to find > an existing program to do this. If I couldn't find one I would: > > 1: use one of the existing programs that can intercept TCP sessions. > Maybe I'd have to teach it how

Re: VNC security

2003-09-16 Thread Björn Persson
Mike Miller wrote: > But it might not be a matter of time because it's so much work for so > little gain? How little gain exactly? Your company's trade secrets? The administrator passwords to all your servers? All the money in your bank account? And let me point out that the work only needs to b

Re: VNC security

2003-09-16 Thread Mike Miller
On Tue, 16 Sep 2003, Bjvrn Persson wrote: > If I wanted to sniff other people's VNC traffic i'd first try to find an > existing program to do this. If I couldn't find one I would: > > 1: use one of the existing programs that can intercept TCP sessions. > Maybe I'd have to teach it how to recognize

Re: VNC security

2003-09-16 Thread Björn Persson
Scott C. Best wrote: > First, when you press "Send" > on a web-browser form, all of the data in that form is sent at > once, in well-delineated form, making the data relatively easy to > identify. In a VNC session, by comparison, every *character* is > sent as soon as you type it, along with other

Re: VNC security

2003-09-16 Thread Scott C. Best
Michael: Heya. I think I'm willing to split this hair over VNC security. First off, I agree with you that VNC users should try to use a secure-tunnel whenever they VNC across the Internet. That just a inarguable Good Idea. For those using VNC to remotely administer their co

RE: Re: VNC security

2003-09-16 Thread Christopher Mc Carthy
Hello, I'm a bit confused. I currently use VNC (the Tight flavour) through an SSH tunnel, so I'm not really concerned, but I thought (from other discussions found in the archives) that VNC was *quite* secure as info/updates was/were sent over the network as images (increasingly compressed, using

Re: VNC security

2003-09-15 Thread Bernard Peek
In message <[EMAIL PROTECTED]>, Michael Herman <[EMAIL PROTECTED]> writes I posted my original e-mail after an off-list discussion with someone who, using Windows 98 on both the client and server, wanted to connect to work. This person appeared to be, from their e-mail signature, an human resour

Re: VNC security

2003-09-15 Thread Michael Herman
On Sun, Sep 14, 2003 at 01:51:58PM -0500, Mike Miller wrote: On Sat, 13 Sep 2003, Michael Herman wrote: I would like to point out that VNC is not secure. >From the realVNC FAQ: > Is VNC secure? >The only really secure computer is one without a network. VNC >requires a password when a viewer tri

Re: VNC security

2003-09-14 Thread Mike Miller
On Sat, 13 Sep 2003, Michael Herman wrote: > I would like to point out that VNC is not secure. > > >From the realVNC FAQ: > > > Is VNC secure? > > >The only really secure computer is one without a network. VNC > >requires a password when a viewer tries to connect to a server. This password > >is e

VNC security

2003-09-13 Thread Michael Herman
I recently joined this list and have noticed that a majority of the posts have the same question - How do I connect to a workstation at work through a firewall, across the Internet, etc. I would like to point out that VNC is not secure. From the realVNC FAQ: Is VNC secure? The only really secu

vnc security... port access... users...

2003-01-18 Thread Bruce Douglas
sorry for the wrong subject on the last one... hey... couple of quick questions... as i was going through past msgs.. and the VNC docs... couldn't find a suitable answer... a vnc client app doesn't log the user into the machine. you apparently have to have a copy of the vncserver running on the

VNC Security & Pocket PC

2002-06-28 Thread Yury German
I have a question for anyone out there that knows pocket PC's. I have a client who wants to issue their support staff PocketPC's with the Cellualr modem so that they can respond to problems from anywhere. The problem is that as we all know VNC is not the most secure out there. What I was wondering