Is it safe to remotely connect to an infected machine via VNC or TeamViewer?

Question

Since there has to be some data transfer between any two machines that have established a connection, is it truly “safe” to connect from a clean computer to an infected one using VNC or TeamViewer?

Answer 1

There is a major difference between using VNC and using TeamViewer in this scenario, I will try to list some of them and I hope someone can edit and add other points that I'll probably forget to mention, but for those who only want the conclusion: Using TeamViewer is safer, but not too safe.

Suggestion: I suggest you booting up from a live Linux distro USB, unmount all HDD partitions, make sure you are NOT root then connect to the other machine, this is the safest way that can defeat most of malwares.

TeamViewer is designed to put some transparency between clients connecting with each other (no local direct connection is established), plus it's well maintained from their team, taking in hand the safety approach as a big factor I can say. In the other hand, VNC is designed to connect locally or remotely (which means it can be more dangerous when used locally).

TeamViewer also keeps live track of the files transferring between devices (by live I mean a pop-up window will be shown with details about files), but when it comes to VNC then you have to go through some logs (if logging is enabled) to find any suspicious activity (Good luck!).

From TeamViewer support site (TeamViewer manual), if you read from page 21 to 23 you can have a better idea of the security file transfer implementation, logging of file transfer operations, ...etc.

Also TeamViewer is designed ontop of VNC project, both are open source softwares which can be a major factor from security perspective, (remember the not so long found hidden 20 years old vulnerability in bash, also ~5 years in Windows, OpenSSL, etc...).

I think the major security advantage is that TeamViewer uses DynGate which is a kind of firewall, it tunnels your connection through HTTP (or secure HTTP), and it doesn't require ports to be opened on the firewall, so for both points, if your system is secure, TeamViewer is a better solution.

I must say in the end, the malware itself should be designed to take advantage of a running service in order to infect your machine, so if the malware is sophisticated enough, not the environment nor the service will matter. An example of trying to take advantage of TeamViewer, let's say I am designing a malware, what I will do is try to establish connections through QuickSupport mode which hides pop-ups and in this mode all file system operations are allowed, but since you are establishing the connection to the infected machine, this implementation won't work because you will decide what mode you want to work with the remote machine not my malware.

Answer 2

To the best of my knowledge, the only potential risk presented when connecting to an infected machine remotely would be if you are doing active file transfers between machines or open up some connection on your local VNC/TeamViewer machine that would allow the infected machine to actively act on your machine.

An edge risk is that—let’s say—your client machine has a similar vulnerability to the infected machine. And that vulnerability is network based… Then let’s say a port is open on your client machine, and the remove machine sees you connecting to their machine… It might start to probe your client machine for vulnerabilities and possibly act on them. But I would consider that an edge case based strictly on malware behavior and not some generic thing one would worry about.

So if you were truly worried and the infected machine is Windows, then I would recommend using a VNC client on a Linux or Mac OS X machine to connect to the remote machine. The difference in operating systems is enough to ensure nothing from the infected machine would magically “jump” to the non-infected VNC client you are using.

In general, I would’t worry… Unless you need to do file transfers.