is vnc secure

Tivoli

i set up vnc server and no-ip running on my pc, now i cna controll it from work or visitors houses, its great for emailing stuff to work ect


i set it up with a strong password,but is it possibal to vnc into the pc without the password

i have zonealarm running

theciscokid

VNC uses the RFB (remote frame buffer) protocol which is unencrypted when passing data , so if someone was sniffing from within your network etc.. its quite easy to snarf.

VNC only needs one piece of data for authentication when logging in, and it allows unlimited connections until you fix that, by default VNC isn't very secure, but you can harden it quite easily.

Also the pass, it can only be 8 characters, there are patches from 'phenoelit' group and others that takes advantage of the 3.3 implementation, so make sure you at least have the lastest one.

The vnc password is also stored on the server using DES which is trivial to crack.. the current key can be retrieved from the vnc source code.. at the moment i think its 23 82 10 76 35 78 88 7 (that may be different) - you can get it from AT+T's site and do your own analysis.

EDIT : keys are stored here

\HKEY_CURRENT_USER\Software\ORL\WinVNC3

\HKEY_USERS\.DEFAULT\Software\ORL\WinVNC3


Best to use Openssh or putty to forward/tunnel the connection over , if its to check work email etc.. you dont want to leave it to chance

Heres some links for educational purposes

http://www.science.smith.edu/~ejensen/vncssh.html

http://www.phenoelit.org/vncrack/

Capt'n Midnight

have a look at ZVNC