• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Security concerns with remote PC control?

E

Ericular

n00b
Joined
Sep 29, 2004
Messages
27
In a home environment, what is the most secure way to access your home PC from work (or any remote location)?

By home environment, I mean something typical like a Linksys router/firewall and Windows XP.

Obviously one method would be to forward port 3389 inside to an XP workstation with remote desktop enabled. Just doesn't seem all that secure though -- anybody can load the login screen and enter passwords all day...and is the password being sent even encrypted? Is the RD session itself even encrypted??

How about with VNC? Is your login password still sent over cleartext?

I could use a non-standard port for remote desktop / VNC, as well as a non-default port for the remote management of the Linksys, but that won't stop them from showing up on a full sweeping port scan, right?

Anyway, I've asked too many questions already, so I'll save the last couple I have for another reply. Any help or recommendations would be appreciated!

- Eric
 
Excellent question and analysis of the problem/risks.

Certainly you could change the port numbers around so it avoids some port scans on the default port. However, you are correct in that a full port scan sweep would still detect the open port wherever you moved it. Security by obscurity is not a reliable defense.

Maybe someone else can provide remote desktop suggestions, but I'll give you some possibilities of security with VNC. I'm not sure whether the VNC password is sent in plaintext, I figure it wouldn't be but it might just. The most secure method of using VNC is through SSH tunnels. Essentially, you would setup an SSH server on your home machine, forward a port to it from your router, and login from your work computer. SSH has the ability to forward and tunnel encrypted ports, so once your SSH connection is established, you would start up VNC and connect through the SSH tunnel. Do a google search for "SSH and VNC" for some examples.

Now, that said, you did bring up an interesting point about brute force attacks. Even if you have a password for SSH, attacks could type (or automate entering) random passwords all day to attempt to gain access. Looking at my log files, many people try to brute force my box all day long. The solution with SSH is to use public-private key based authentication instead of passwords.

Rather than logging in using a username and passphrase, you create an SSH private key on your work machine, and add the public key to the allowed list of keys on your SSH server. When you login from work, you are not authenticating a user per say, but rather a remote machine. This makes it much more difficult for an attacker to brute force his way in. If you set this up, you want to make sure to disable password based authentication, and allow only key based.
 
VNC 3.3 and 4.0 basic use clear text for password. There's an enterprise version of 4.0 which will encrypt them.

Other options include gotomypc.com or equivalent.
 
I don't know much, but try looking up Tight VNC, hell, I'll even be nice and link ya. I think it's a little more secure than standard VNC.
 
You must log in or register to reply here.
Back
Top