0 Replies Latest reply: Nov 19, 2012 2:51 PM by chicodaman
chicodaman Level 1 Level 1 (15 points)

I have a Macbook I use as a media server. I was checking security.log via console, and saw a continuous stream of attempted but failed VNC logins. I have it set up for outside access (through a router) so I can control it while on the road.

 

I don't keep any private data on this machine (it's only for my media center needs) but this seems curious. Note that the attempts to log in come from many different ip addresses (which may be to camoflage the attacker).

 

Anybody have any thoughts on this?  Thanks....   chico

 

Nov 16 16:56:03 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 188.130.251.27 :: Type: VNC DES

Nov 16 16:56:33: --- last message repeated 4 times ---

Nov 16 17:18:42 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 86.34.194.62 :: Type: VNC DES

Nov 16 17:19:22: --- last message repeated 1 time ---

Nov 16 17:19:22 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 89.121.248.75 :: Type: VNC DES

Nov 16 17:20:24: --- last message repeated 1 time ---

Nov 16 17:20:24 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 78.46.69.23 :: Type: VNC DES

Nov 16 17:22:15: --- last message repeated 1 time ---

Nov 16 17:22:15 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 188.64.186.139 :: Type: VNC DES

Nov 16 17:22:34: --- last message repeated 1 time ---

Nov 16 17:22:34 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 89.122.216.132 :: Type: VNC DES

Nov 16 17:24:27: --- last message repeated 1 time ---

Nov 16 17:24:27 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.41.216.228 :: Type: VNC DES

Nov 16 17:43:30: --- last message repeated 1 time ---

Nov 16 17:43:30 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 94.236.192.198 :: Type: VNC DES

Nov 16 17:44:00: --- last message repeated 1 time ---

Nov 16 17:55:04 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 89.121.161.232 :: Type: VNC DES

Nov 16 17:57:03 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 220.249.99.34 :: Type: VNC DES

Nov 16 18:00:08: --- last message repeated 4 times ---

** THIS IS ME CONNECTING FROM REMOTE SITE **

Nov 16 18:00:08 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: SUCCEEDED :: User Name: mediacenter :: Viewer Address: 76.126.xxx.xxx (** REDACTED BY ME**) :: Type: DH

Nov 16 18:30:44 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:31:14: --- last message repeated 18 times ---

Nov 16 18:31:14 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:31:44: --- last message repeated 19 times ---

Nov 16 18:31:44 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:32:17: --- last message repeated 16 times ---

Nov 16 18:32:17 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:32:49: --- last message repeated 8 times ---

Nov 16 18:32:49 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

Nov 16 18:33:19: --- last message repeated 15 times ---

Nov 16 18:33:19 Media-Center /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Ma cOS/AppleVNCServer[164]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 212.43.129.8 :: Type: VNC DES

 

ETC. ETC. ETC.

 

Any ideas, anyone?


MacBook, Mac OS X (10.6.8), Running 10.6.8 on the media server.