2

I have screensharing enabled on my Mac. I make use of the feature often to remotely control my Mac from public computers.

However, while looking through the console today, I noticed this message appearing about once every ten seconds:

screensharingd[13223]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 60.6.38.2 :: Type: VNC DES

So, it seems that someone with the IP address 60.6.38.2 is trying to connect to my computer via screen-sharing, and possibly attempting to brute-force my password. Is there any way I can block this guy without actually turning off screen sharing?

Edit: I should probably note that I'm aware my system is not ideal from a security perspective. I just want a way to block this one IP.

1

The bigger question here is why is your Mac not behind a firewall that is doing some sort of port filtering/forwarding as well as stateful packet inspection?

If you were behind a firewall you could block/filter out IP addresses, but this is only temporary because all the attacker has to do is change their IP.

Instead of VNC, which in my opinion is very weak in terms of both security and functionality and instead go for a product like TeamViewer (free for personal use) and you don't have to open any ports on your firewall to use it.

By the way, your attacker is coming from China....

enter image description here

  • Not behind a router because I'm in a college dorm. I knows there's safer ways/tools for this, but I like using the options built into my Mac and I'm not super worried about security (there's nothing particularly sensitive on this computer). I just want to be able to block this one IP. – Wowfunhappy Mar 8 '16 at 23:43
  • To block an IP, you need a firewall that will examine the packet of data coming in and then drop the connection. OS X used to have ipfw, but it has been deprecated. I am assuming you can't use a router on your college network because they have RADIUS or something that allows access by MAC address. Just get a router that spoofs your Apple's Mac Address. – Allan Mar 8 '16 at 23:54
  • 1
    It not about what is on your computer...it's more about your computer becoming part of a bot net used for nefarious things. Security is all of our responsibility. – Allan Mar 8 '16 at 23:55
  • From what I can understand, it looks like ipfw has been replaced by pf in newer versions of OS X. I don't understand enough to figure out how to block an IP, though. – Wowfunhappy Mar 9 '16 at 0:00
  • I haven't spent enough time developing pf tables just yet, but I found a good document that you might be able to use to set up your firewall: sites.sas.upenn.edu/kleinkeane/files/macnet-pf_1.pdf – Allan Mar 9 '16 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .