I have one XP machine up and running -- I can't remember exactly, but it =
appears as if it's very close to or exactly the same as the W2k install.
It appears that you have a stronger understanding of computer security =
than I do -- so trust your instincts. A static IP on your side is a =
nice security measure, but could someone spoof it? =20
I am more comfortable leaving a SSH port open than a VNC port open -- my =
mantra is to run a tight ship -- and to minimize risk, especially where =
I may not understand it 100%. =20
Call me paranoid -- but given the option, I prefer to encrypt everything =
I can. =20
Date: Wed, 19 Jul 2006 19:50:53 -0700
From: Allen <netsecurity@...>
Subject: Re: VNC-Tight-list Digest, Vol 2, Issue 11
Content-Type: text/plain; charset=3DISO-8859-1; format=3Dflowed
I've read your process and have a fairly clear grasp of what is going
on. I really only have a couple of questions.
The first is that I assume the process is the same for W2K as XP, right?
The second is that I'm not clear on what you mean by:
> Theory: First of all, it's a *really* bad idea to forward 5900
> through your modem -- VNC is (a) not a secure transmission, so any
> motivated cracker with a sniffer can watch exactly what you're doing
> and typing, including passreplaces,=20
Yes, I understand most VNC servers/clients are not encrypted, but unless =
there is DNS cache poisoning, ARP flooding or a couple of other corner=20
cases where the attacker is already on their local LAN, how is someone=20
going to sniff traffic over the hardwire Internet without being on the=20
same pipe using a man in the middle attack? Wireless I can see, but=20
hardwire? I'd like to understand how this type of attack would work.=20
Since it is mostly OT to this list you can write directly to me if the=20
list would prefer.
In my case, I have a dotted quad fixed IP address and my parents are on=20
a dynamic dotted quad IP for the WAN. Assuming that the server is on my=20
parents end and they have the connection set to only accept a connection =
from my IP address and using the password I know, how does an attacker=20
get the data flow unless they have compromised a router in between?
I'm certainly not saying that it can't be done, I just can't visualize =