VNC attack attempts on OS X 10.10 -- should I worry/respond?

If I turn on OS X "Screen Sharing" (i.e., VNC access), my console log gets regular messages like the following:

screensharingd[1584]: Authentication: FAILED :: User Name: N/A :: Viewer Address: <random IP redacted> :: Type: VNC DES

These occur every few minutes, with varying, more or less random, IP addresses... Turning off screen sharing stops the attacks for a few minutes, but they usually restart within a little of while if restarting (which I do need!).

I am not particularly worried about the actual attack succeeding but should I be worried about excess network traffic and just filling up the log files with un-necessary crap? I would strongly prefer not to have to use any third-party software if possible.

My machine is behind a cable modem and Apple Time Capsule which does all the NAT stuff and forwards appropriate ports to this machine.

For what it's worth, under Mavericks /etc/hosts.deny doesn't seem to have any effect, but I understand that I could possibly use pfctl?

(I've got a similar question about ssh attacks...)


It looks like somebody is connecting using a RealVNC, TightVNC or Tiger VNC client, that's why username is N/A.

If your VNC anonymous password is really simple then you should worry, otherwise - no.

It is set up in System settings -> Sharing -> Remote Management -> Computer settings -> "VNC viewers may control screen with password" and can be different from user password.