Hi All,

I need some advice please.

I have conducted a vulnerability assessment on a client's external network and have discovered an open VNC port (both client and web) which one can conect to from any IP on the Internet.

I know that the vulnerability related to VNC is that you can sniff the credentials as they are by default sent in open text (the client is not tunnelling this through SSH).

As far as I know, to sniff the password you would need to either have access to a router between two connections or else interpose yourself in a 'man-in -the-middle'. You would also be able to sniff the traffic if you were plugged into a hub (or switch with promiscuity set accordingly) with either of the end points.

Taking these scenarios into account it would be a highly unlikely that the password could be sniffed if these vectors were suitably protected. Am I missing something here which makes the risk of password sniffing very likely of occuring?

The client does not need to comply to SOX so I cannot use that as leverage in getting him to close this down. I can only plead to his common sense.

Any advice or insight would be much appreciated.

Thanks

Chris

I've always believe that security is as strong as your weakest link.   How is the physical security?  What about wireless?   If either of those are lacking, it's an entry point to the LAN and you can then sniff whatever you want.   There could be unsecured machines on the LAN that an attacker can compromise and use to sniff passwords.  There are often HVAC, Voice Mail, Key Card Access control machines running very unsecured versions of Windows that are very easily compromised.   When you are explaining your findings, you can try to paint a picture where your VNC issue is just one of the steps on a footpath to a compromised network.

I also usually mention some of the historical vulnerabilities that have existed in VNC, like the authentication bypass one.   I have found that this is pretty good leverage.

Jason, I hadn't seen that tool before.  Thanks!

Thank you for the advice.

Much appreciated!