2

I have several nefarious individuals attempting to gain access to my servers constantly with VNC, presumably using some kind of dictionary attack against the password.

Is there a way to get a log of the actual attempts being made inclusive of the VNC password or in this case the macOS username and password being attempted?

I can see the logged attempts at the connections in my firewall software... just not the actual data from the attempts by 45.115.39.125, 185.148.147.101... (the most persistent two).

|improve this question
2

I don't know an answer to the question you asked, but from an IT security best practices perspective:

Run VNC on a local interface only. Use a key-based vpn or ssh tunnel to access the local interface remotely.

Is there a reason you need to run VNC on a non-secure interface?

|improve this answer
  • If you look at the history of vulnerabilities in unix in general, the worst ones, and the ones that execute programmatically (aka easiest for the script kiddy hacker to launch) almost always involve command line access to the system. For that reason I never allow SSH to any server short of from the console. Beyond that, the attacks hit a brick wall so I am not terribly concerned, but I would like more insight into the techniques that are being employed... and to watch pattern of the attempts. It's more of watching a poisonous spider from the safety of distance and a thick glass barrier. – William Cerniuk May 3 '18 at 11:32
  • If you use key-based login of sufficiently complicated & large key size (>=2048 bit) it's not considered possible with today's cryptanalysis techniques to guess this key within any reasonable time. Even ignoring this, VPN =/= ssh and implementing an openVPN server does not grant ssh access; you could shutdown the ssh daemon or firewall off port 22 completely and still have a secure connection to your VNC server, if that's what you're interested in achieving. – Scottmeup May 3 '18 at 12:12
  • Also, I'm not sure that an unauthorised VNC session is going to be any less damaging than an unauthorised ssh session. For a bad actor with VNC access, going on to then establish a reverse-ssh tunnel is a fairly trivial process. I suspect that guessed passwords are not logged in order to prevent someone with access to the system seeing a user's password. Even if it's an incorrect password it may be close to a user's actual password. Since VNC uses encrypted login it's not possible to sniff packets either. – Scottmeup May 3 '18 at 12:59
  • Thanks Scottmeup. My configuration goes beyond the description stated or inferred here... and I would rather not describe in public forum ;-) I'm really not trying to further secure the server in as much as I am trying to get an idea of the methods being used in the attempt to break in (however pointless their efforts may be). For the sake of argument, lets say I am not really using VNC but interested in the bad actor's approaches on what they think is a VNC service on port 5900 – William Cerniuk May 3 '18 at 22:25
  • Wellp, if you have the skills and enough knowledge about the VNC protocol I assume you could write something to negotiate the initial connection and write login details to a log file. Aside from that I'm not sure I can think of anything that would help. – Scottmeup May 4 '18 at 3:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .