The None and VNC Authentication security types send subsequent RFB protocol data without encryption. Other registered or vendor mechanisms can add TLS, SASL protection, RSA-AES, SSH tunneling, or other security properties. Determine exposure from the type and subtype selected for the actual session, including certificate or peer validation where applicable. When a server offers both protected and cleartext types, unauthenticated negotiation may permit an on-path attacker to steer a compatible client toward a weaker type the server already accepts; a server offering only protected types is not bypassed by inventing another selection.
# inventory advertised security types; this alone does not prove which type a session uses
nmap -p5900 --script vnc-info <target>
tcpdump -i eth0 -w vnc.pcap port 5900 # capture for analysis
Subtopics#
- Cleartext transmission: reading the unencrypted desktop and credentials.
- Weak encryption: weak or optional encryption modes.
- Security type downgrade: forcing a weaker security type.