How VNC Works: Remote Screen Sharing & Exposed VNC Risks (Animated)

VNC shares a computer’s screen and lets someone else control it. It’s common for IT support and is built into many industrial control panels and appliances. Its classic password scheme is weak, and internet scans regularly find VNC screens with no password at all.

1. Handshake: version and security type

Both sides agree on the RFB protocol version, then the server says which security types it allows. “None” means no password at all.

1. RFB 003.008 (Office PC (VNC) → Support laptop): The server announces its version.
2. SECURITY TYPES (Office PC (VNC) → Support laptop): Security type 2: a password challenge.

Wireshark filter:

vnc

2. Authenticate: a weak, old challenge

Classic VNC authentication encrypts a 16-byte challenge with the password using old DES, and only the first 8 characters of the password count.

1. CHALLENGE (Office PC (VNC) → Support laptop): A random challenge.
2. RESPONSE (Support laptop → Office PC (VNC)): The answer proves the password, weakly.
3. OK (Office PC (VNC) → Support laptop): Accepted.

Wireshark filter:

vnc.auth_challenge

3. Screen & input: pixels out, clicks in

The server sends rectangles of changed screen; the viewer sends key and mouse events.

1. FRAMEBUFFER (Office PC (VNC) → Support laptop): The remote screen appears.
2. INPUT (Support laptop → Office PC (VNC)): Full control.

Wireshark filter:

vnc.client_message_type

4. Exposed vnc: attack: an open screen on the internet

Search engines that scan the internet list thousands of VNC servers, many with security type “None” or a short password. Anyone can then watch the screen and take control, including factory and building control panels.

1. SECURITY TYPES (Office PC (VNC) → Attacker): The server offers no authentication at all.
2. FRAMEBUFFER (Office PC (VNC) → Attacker): The attacker sees and controls the desktop.

Wireshark filter:

vnc.security_type == 1

5. Tunnel it: defence: never expose 5900

Block VNC at the internet edge, require a strong password or account login, and reach VNC only through SSH or a VPN. Inventory and scan your own ranges for 5900–5910.

1. SYN (Attacker → Office PC (VNC)): From the internet there is nothing to find.
2. SSH TUNNEL (Support laptop → Office PC (VNC)): Support staff connect through an encrypted SSH tunnel instead.

Tunnel over ssh:

ssh -L 5901:localhost:5900 user@office-pc
then connect the viewer to localhost:5901

FAQ