is VNC vulnerable?

[abc]

are any of the variants of VNC more safe than the others.... can others remote to one of your PCs that you've installed the VNC client?

i'd like to try ultravnc...

 

[ultimatebob]

Originally posted by: abc
are any of the variants of VNC more safe than the others.... can others remote to one of your PCs that you've installed the VNC client?

i'd like to try ultravnc...

RealVNC, TightVNC, and UltraVNC all send information (excluding the password) unencrypted, so they are vulnerable to packet sniffing. Of course, you would have the same problem with FTP or telnet, and people still use those all the time.

 

[pulse8]

I believe there's a way to run VNC through an SSH tunnel, but I don't know exactly how to do it.

 

[n0cmonkey]

It shouldn't be too tough to run through an SSH tunnel. Tunnel a few ports...

 

[drag]

Or you could just use a different password for each session or change it a lot.

I mean that VNC uses it's own password and not the user's password, doesn't it?

 

[n0cmonkey]

Originally posted by: drag
Or you could just use a different password for each session or change it a lot.

I mean that VNC uses it's own password and not the user's password, doesn't it?

That is correct. But tunneling it over SSH makes it much more secure.

 

[CTho9305]

Originally posted by: n0cmonkey

Originally posted by: drag
Or you could just use a different password for each session or change it a lot.

I mean that VNC uses it's own password and not the user's password, doesn't it?

That is correct. But tunneling it over SSH makes it much more secure.

SSH tunneling is easy to do, too, as long as the VNC server is also running an SSH server.

 

[ultimatebob]

Originally posted by: drag
Or you could just use a different password for each session or change it a lot.

I mean that VNC uses it's own password and not the user's password, doesn't it?

RealVNC and TightVNC use their own password, but UltraVNC uses Windows authenication to log on. RealVNC and TightVNC also have a weird bug that causes them to reset the VNC password back to the original installation value if you run them as a system service and you reboot the system. So, you can change the password while the server is running, but don't forget the original password if you need to reboot.

 

[loup garou]

Originally posted by: ultimatebob

Originally posted by: drag
Or you could just use a different password for each session or change it a lot.

I mean that VNC uses it's own password and not the user's password, doesn't it?

RealVNC and TightVNC use their own password, but UltraVNC uses Windows authenication to log on. RealVNC and TightVNC also have a weird bug that causes them to reset the VNC password back to the original installation value if you run them as a system service and you reboot the system. So, you can change the password while the server is running, but don't forget the original password if you need to reboot.

Windows authentication is an option in UltraVNC, you don't have to use it.