0

I'm running a small LAN with no WiFi. 2 XP machines, 1 Vista, 2 printers, and a DVR for security cameras.

Last week I set up RealVNC (the personal version, with no encryption) so that I could Remote view the computers within the network.

I also setup a VNC with LogMeIn Hamachi so that I can access the LAN from the internet.

I opened port 5900 on my firewall.

Also I turned off Authentication in RealVNC figuring that the security through Hamachi would be sufficient.

I was planning on closing port 5900 and checking to see if the setup would still work.

Lo and behold, this morning someone accessed my computer via VNC while I was sitting in front of it. I saw the program start up and the mouse move.

Before thinking I disconnected my modem. However I am now unable to find any log of Incoming IP addresses. I checked Windows Firewall and the option for logging incoming connections was not enabled.

I figured my setup would be safe because I was using a password protected VPN.

  • Where did I go wrong?
  • How can I protect myself?
  • Am I being specifically targeted?
  • How can I find out who it was?
  • Where should I go from here?

Right now I'm afraid to even connect my LAN to the internet again.

Please Advise!

Improve this question
7
  • You setup a VNC server without a password that is what you did wrong. Its not possible to know if you were targeted, its unlikely though, unless you are a high value target.
    – Ramhound
    Commented Feb 1, 2014 at 13:36
  • So does is my IP added to a listed of VNC servers? Or was some one scanning for open port 5900?
    – user114772
    Commented Feb 1, 2014 at 14:07
  • When dealing with Windows XP port scanning is really popular. I hope you understand it will only get worst after April.
    – Ramhound
    Commented Feb 1, 2014 at 14:13
  • Why Xp? and Why April?
    – user114772
    Commented Feb 1, 2014 at 14:17
  • I bring it up because your using Windows XP. As to the reason they attack Windows XP because its the low hanging fruit, its an easy target, most Windows XP machines are insecure and are vulnerable to attack. Windows XP security updates stop in April. Many believe the day after support ends there will be a massive attack against those machines. If it turns out this happens, if a Windows XP is connected to the internet, they will be compromised.
    – Ramhound
    Commented Feb 1, 2014 at 14:21

2 Answers 2

Reset to default
0

Here are some steps to improve the configuration:

Well, now we need these safety mechanisms to protect XP more than ever. There should be one administrator account per machine, maximum, and this should not be the default “Administrator” account that comes with Windows out of the box – it should an account name only you, the machine owner knows. That way if something malicious gets onto the box it’ll only be able to potentially destroy your profile, not the whole OS.

Your accounts need to look like this – default Administrator account disabled with another user created for admin tasks, with a strong password.

Finally, make sure you disable enumeration of the computer accounts for anonymous users so nobody can/could query the XP machine for what accounts there are without authentication. Given all the changes we’ve made above this would be very difficult anyway but good security is a layered-cake approach, not any silver-bullet.

Windows XP needs to respond to zero traffic sent to it as that’s a huge vector for attack even on a good day. This means no listening services as we’ve done above but we’re going to double-tap this problem by activating the firewall and setting it to block all inbound traffic with no exceptions.

There’s no outbound firewall restrictions in XP so this is about as good as we’re going to get. I’d strongly recommend doubling-up the firewall with something external too and configuring outbound restrictions too.

References

Improve this answer
0

Since someone else just answered this ... unencrypted VNC is like leaving your front door open, using XP is like locking a flimsy door, and Hamachi, eh, its a lazy man's VPN but not THAT bad.

It sounds like you haven't actually locked VNC to the VPN, and it's still openly accessible over the internet. What you need to do if you want passwordless VNC (eugh, just use RDP) on your LAN is to block the VNC port on your internet gateway but leave it open on the machine itself. This means that in order to attempt VNC access, one would need to be on the local network (I.E. VPN'd in).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .