Skip navigation

Attempted VNC break-ins

412 Views 0 Replies Latest reply: Nov 19, 2012 2:51 PM by chicodaman RSS
chicodaman Level 1 Level 1 (15 points)
Currently Being Moderated
Nov 19, 2012 2:51 PM

I have a Macbook I use as a media server. I was checking security.log via console, and saw a continuous stream of attempted but failed VNC logins. I have it set up for outside access (through a router) so I can control it while on the road.

 

I don't keep any private data on this machine (it's only for my media center needs) but this seems curious. Note that the attempts to log in come from many different ip addresses (which may be to camoflage the attacker).

 

Anybody have any thoughts on this?  Thanks....   chico

 

Nov 16 16:56:03 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 188.130.251.27 :: Type: VNC DES

Nov 16 16:56:33: --- last message repeated 4 times ---

Nov 16 17:18:42 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 86.34.194.62 :: Type: VNC DES

Nov 16 17:19:22: --- last message repeated 1 time ---

Nov 16 17:19:22 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 89.121.248.75 :: Type: VNC DES

Nov 16 17:20:24: --- last message repeated 1 time ---

Nov 16 17:20:24 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 78.46.69.23 :: Type: VNC DES

Nov 16 17:22:15: --- last message repeated 1 time ---

Nov 16 17:22:15 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 188.64.186.139 :: Type: VNC DES

Nov 16 17:22:34: --- last message repeated 1 time ---

Nov 16 17:22:34 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 89.122.216.132 :: Type: VNC DES

Nov 16 17:24:27: --- last message repeated 1 time ---

Nov 16 17:24:27 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.41.216.228 :: Type: VNC DES

Nov 16 17:43:30: --- last message repeated 1 time ---

Nov 16 17:43:30 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 94.236.192.198 :: Type: VNC DES

Nov 16 17:44:00: --- last message repeated 1 time ---

Nov 16 17:55:04 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 89.121.161.232 :: Type: VNC DES

Nov 16 17:57:03 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 220.249.99.34 :: Type: VNC DES

Nov 16 18:00:08: --- last message repeated 4 times ---

** THIS IS ME CONNECTING FROM REMOTE SITE **

Nov 16 18:00:08 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: SUCCEEDED :: User Name: mediacenter :: Viewer Address: 76.126.xxx.xxx (** REDACTED BY ME**) :: Type: DH

Nov 16 18:30:44 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:31:14: --- last message repeated 18 times ---

Nov 16 18:31:14 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:31:44: --- last message repeated 19 times ---

Nov 16 18:31:44 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:32:17: --- last message repeated 16 times ---

Nov 16 18:32:17 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:32:49: --- last message repeated 8 times ---

Nov 16 18:32:49 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:33:19: --- last message repeated 15 times ---

Nov 16 18:33:19 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

 

ETC. ETC. ETC.

 

Any ideas, anyone?

MacBook, Mac OS X (10.6.8), Running 10.6.8 on the media server.

Actions

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.