The Microsoft Remote Desktop is an application that has just been updated in the App Store and allows access to our PC from an iPad or an iPhone. An option that is also available in the Google Play Store.
But it is not the only way to get remote access. Microsoft may be the best known option with TeamViewer and with them a multitude of options that we now know, can compromise the security of our team.
Troy Horse
VNC, acronym for Virtual Network Computing, is an app that allows us to connect remotely to our computer, as we have seen with "Microsoft Remote Desktop". And some of them, all based on VNC, are now in the eye of the hurricane according to the information they provide in Kaspersky.
VNC is a free software based on client-server structure that allows remote access to a computer and use it from another device. It is the basis of programs such as LibVNC, TightVNC 1.X, TurboVNC and UltraVNC or RealVNC, alternatives available for almost all operating systems on the market.
The problem is that everything we do remotely on the PC is transmitted over the network and the keystrokes, mouse movements are included here ... and if it is not well protected, this set of data may fall in the hands of possible cyber attackers.
So from Kaspersky they have discovered that VNC-based programs offer serious security errors on almost all servers, which is the part of the application that we will install on the PC. Security failures that cause unexpected shutdowns without gravity until malicious code can be executed remotely without the user knowing.
And so that we have an idea of the magnitude they remind us that according to shodan.io data, more than 600,000 VNC servers are available online, a number that grows significantly if we add the devices that are available in local networks.
According to Kaspersky's analysis, many of the security flaws discovered today are still active and unpatched, so it warns users of a VNC-based application about the risk their data is suffering.
In the research they have studied some of the best known applications such as LibVNC (an open source cross-platform library to create a custom application based on the RFB protocol), UltraVNC (a popular open source VNC implementation developed specifically for Windows), TightVNC X (a more popular implementation of the RFB protocol) or TurboVNC (an open source VNC implementation).
In the process, Kaspersky concludes that these problems can be at least controlled if we carry out a series of basic steps with which to define the risk in our equipment:
- It is necessary to check which are the devices that can be connected remotely to the computer, blocking those that we do not consider safe and creating a white list.
- When we are not going to use the remote connection it is convenient to disable VNC.
- Always have the latest version of this software installed, both on the client and on the server.
- It is convenient to use a strong password.
- Do not use servers that are not trusted.