1

Let's say I connect to a Linux VNC server from a compromised Windows client.

Would this affect by any mean the server security?

Note:

  • The server run on a limited user privileges.
  • The programs that is used is TigerVNC or TightVNC.
WhiteWinterWolf
  • 19,082
  • 4
  • 58
  • 104
cloud em
  • 23
  • 5

1 Answers1

4

If an attacker has taken control of your client host, and from this client host you connect to the VNC server, expect the attacker to have at the very least the same privileges as you on the VNC server's host and a complete view of your activity during the VNC session (screen content, keystrokes, etc.).

That's typically how an attacker progressively contaminate a full network: he starts by getting his hand on a few unprivileged client machines (through phishing emails or any other mean), then through this machines and using the user's legitimate accesses he can escalate to internal servers not directly accessible from the outside.

WhiteWinterWolf
  • 19,082
  • 4
  • 58
  • 104
  • would that still be the case if the vnc program is encrypted with no file transfer and only the privilege to run certain programs like a web browser. and the server O.S is some thing like freepto O.S and by what mean can I secure this . I may as will make changes to one of tightvnc or tigervnc source code and work on them as my graduation project – cloud em Dec 19 '15 at 18:32
  • @cloudem: As long as you consider the client host compromised, you cannot have any security expectancy with it anymore. All what the legitimate could do, the attacker can do them as well. All the secrets and knowledge the legitimate user uses on this host is now known to the attacker as well. The only last fences mitigating the attacker propagation would be compartmentalization (at the host and network level, lesser privileges is a must) and the use of secrets which do not rely solely on the user's knowledge (two-factor authentications, one-time-passwords, etc.). – WhiteWinterWolf Dec 19 '15 at 19:02
  • @cloudem: The only real security is to be able to ***detect*** that the client has been compromised, so you can isolate it from the network and [handle it correctly](http://security.stackexchange.com/questions/39231/how-do-i-deal-with-a-compromised-server). – WhiteWinterWolf Dec 19 '15 at 19:05
  • just to be sure about it .. there is no way to go around this even when using any other desktop sharing protocol or program ?? – cloud em Dec 19 '15 at 19:17
  • 1
    @cloudem - Nope. Can't get around it. For example, if the host has a keylogger, it can record everything you type, including your password. Nothing you can do will avoid this. You mention modifying VNC apps as a possible solution. The problem with that is that you can't be sure your modified program is even being run on a compromised host. How can you be sure of anything when a compromised computer is controlling all of your inputs and outputs? – Neil Smithline Dec 19 '15 at 19:24
  • @cloudem: No, no way to go around it, only ways to slow down the attacker so you get a few time and have a chance to detect the security incident and react properly before he goes too deeply in your network. – WhiteWinterWolf Dec 19 '15 at 19:34