VNC is a remote desktop tool, and VNC servers left open on the internet with no login are a risk, especially when they connect to industrial control systems. The post explains the risks and the steps that reduce exposure. It concerns IT and industrial control teams.
VNC graphical desktop sharing system is a program developed to provide users with the convenience of remote control of a computer or system. CISA warns that when a human machine interface (HMI) is exposed to the internet without proper controls, attackers can view it, make unauthorized changes and disrupt operations, as set out in the CISA and EPA fact sheet on internet-exposed HMIs.Why does port 5900 matter?
Port 5900 is the default port of VNC servers, so exposed VNC services are easy for attackers to find and probe. VNC has proven vulnerable to brute force attacks, and MITRE ATT&CK notes that adversaries use VNC to run commands, collect data and move across networks. When VNC is reachable from the internet and connected to HMI, SCADA/ICS systems and workstations, those critical infrastructure systems are at risk. Threat actors targeting the security of such systems can interfere with predefined configurations, take industrial control systems (ICS) out of service, disrupt the supply chain and processes in the affected industries, or gain access to sensitive data that can be used to compromise ICS systems.How can organizations reduce VNC exposure?
Warning: Open VNC without a loginLeaving VNC open to the Internet without authentication makes it very easy for threat actors to break into the network. Keep critical systems behind firewalls and minimize Internet exposure of VNC.
- Ensure that critical systems in the IT environment are behind firewalls,
- Internet exposure of VNCs should be minimized.
- SCADA/ICS systems should be used in the latest versions published by the official vendor,
- Strong password policies should be enforced within the organization,
- Access controls within the organization should be configured correctly,
- Network traffic should be constantly monitored for the security of the institution/organization inventory,
- All necessary security measures for VNC must be enabled,
- Cyber security awareness should be raised for those working in the SCADA/ICS environment.