VNC attack attempts on OS X 10.10 -- should I worry/respond?
If I turn on OS X "Screen Sharing" (i.e., VNC access), my console log gets regular messages like the following:
screensharingd[1584]: Authentication: FAILED :: User Name: N/A :: Viewer Address: <random IP redacted> :: Type: VNC DES
These occur every few minutes, with varying, more or less random, IP addresses... Turning off screen sharing stops the attacks for a few minutes, but they usually restart within a little of while if restarting (which I do need!).
I am not particularly worried about the actual attack succeeding but should I be worried about excess network traffic and just filling up the log files with un-necessary crap? I would strongly prefer not to have to use any third-party software if possible.
My machine is behind a cable modem and Apple Time Capsule which does all the NAT stuff and forwards appropriate ports to this machine.
For what it's worth, under Mavericks /etc/hosts.deny doesn't seem to have any effect, but I understand that I could possibly use pfctl
?
(I've got a similar question about ssh attacks...)
It looks like somebody is connecting using a RealVNC, TightVNC or Tiger VNC client, that's why username is N/A.
If your VNC anonymous password is really simple then you should worry, otherwise - no.
It is set up in System settings -> Sharing -> Remote Management -> Computer settings -> "VNC viewers may control screen with password" and can be different from user password.