If I turn on OS X "Screen Sharing" (i.e., VNC access), my console log gets regular messages like the following:

screensharingd[1584]: Authentication: FAILED :: User Name: N/A :: Viewer Address: <random IP redacted> :: Type: VNC DES

These occur every few minutes, with varying, more or less random, IP addresses... Turning off screen sharing stops the attacks for a few minutes, but they usually restart within a little of while if restarting (which I do need!).

I am not particularly worried about the actual attack succeeding but should I be worried about excess network traffic and just filling up the log files with un-necessary crap? I would strongly prefer not to have to use any third-party software if possible.

My machine is behind a cable modem and Apple Time Capsule which does all the NAT stuff and forwards appropriate ports to this machine.

For what it's worth, under Mavericks /etc/hosts.deny doesn't seem to have any effect, but I understand that I could possibly use pfctl?

(I've got a similar question about ssh attacks...)

  • you could use a non-standard port. Say screen sharing listens on 1234 by default (idk what it actually is). Instead of forwarding 1234 via NAT, you could forward 12345 and point it to 1234 internally. No idea how to do this with time capsule, but that's how I'd do with with a router – Russell Uhl Apr 23 '15 at 15:35

It looks like somebody is connecting using a RealVNC, TightVNC or Tiger VNC client, that's why username is N/A.

If your VNC anonymous password is really simple then you should worry, otherwise - no.

It is set up in System settings -> Sharing -> Remote Management -> Computer settings -> "VNC viewers may control screen with password" and can be different from user password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.