Virtual Network Computing (VNC) increasingly used as an attack vector

guest · Aug 14, 2022

Over 9,000 VNC servers exposed online without a password
August 14, 2022

Researchers have discovered at least 9,000 exposed VNC (virtual network computing) endpoints that can be accessed and used without authentication, allowing threat actors easy access to internal networks.

VNC (virtual network computing) is a platform-independent system meant to help users connect to systems that require monitoring and adjustments, offering control of a remote computer via RFB (remote frame buffer protocol) over a network connection.
Click to expand...

If these endpoints aren’t properly secured with a password, which is often the result of negligence, error, or a decision taken for convenience, they can serve as entry points for unauthorized users, including threat actors with malicious intentions.
Alarming findings
Security weakness hunters at Cyble scanned the web for internet-facing VNC instances with no password and found over 9,000 accessible servers.
Click to expand...

To make matters worse, Cybcle found some of these exposed VNC instances to be for industrial control systems, which should never be exposed to the Internet.

“During the course of the investigation, researchers were able to narrow down multiple Human Machine Interface (HMI) systems, Supervisory Control And Data Acquisition Systems (SCADA), Workstations, etc., connected via VNC and exposed over the internet,” details Cyble in the report.
Demand for VNC access
Demand for accessing critical networks via exposed or cracked VNCs is high on hacker forums, as this kind of access can, under certain circumstances, be used for deeper network infiltration.

"Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands," a Cyble researcher told Bleeping Computer during a private discussion.
Click to expand...

Cyble: Cyble Global Sensor Intelligence Observes An Increase In Attempts To Exploit VNC

Exposed VNC A Major Threat To Critical Infrastructure Sectors
While the demerits of exposing VNC over the internet have been previously discussed, there are still over 8000 exposed VNC instances with authentication disabled, as shown below.
As shown below, China, Sweden, and the United States are among the top 5 countries with exposed VNCs over the internet.
Click to expand...

However, if organizations do not have the appropriate safety measures and security checks in place, this situation can lead to severe monetary loss for an organization. Leaving VNCs exposed over the internet without any authentication makes it fairly easy for intruders to penetrate the victim’s network and create havoc.
Click to expand...

Log in or Sign up

Virtual Network Computing (VNC) increasingly used as an attack vector

guest Guest

Log in or Sign up

Virtual Network Computing (VNC) increasingly used as an attack vector

guest Guest

Useful Searches