How are people running their Macs exposed directly to the Internet?
In order to make this work, a user would have to:
- Turn on screen sharing
- Turn off the OS firewall block
- Set up NAT routing on their router to forward port 5900 to their Mac
Seems to me that anyone who could do this would know it was a really bad idea?
Especially since you can already tunnel screen sharing via Apple ID or FaceTime to connect without leaving the port open.
One of the ways it can happen is if a router doesn’t have a proper IPv6 firewall.
The majority of internet users in the USA have IPv6 connectivity - something like 55-60% overall, and close to 100% on some networks. T-Mobile’s network is 100% IPv6-only, using 464XLAT for connectivity to legacy IPv4-only servers. Most Comcast customers have IPv6 too, as they were the first major ISP to roll out IPv6, close to 15 years ago now.
Without an IPv6 firewall on the router, all devices on your network are directly accessible from the outside world (unless they’re running their own firewall, of course). At least Windows ships with a firewall enabled by default, which reduces the impact for Windows users.
I’ve seen this in places you wouldn’t expect it, too. TP-Link’s prosumer/SMB 10Gbps router (Omada ER8411) didn’t have an IPv6 firewall until about a year after launch. I had to disable IPv6 until then. They did add it, but I’ve since switched to a Unifi Cloud Gateway Fiber.
Thankfully I haven’t seen it recently, so maybe it’s not an issue any more on modern hardware.
NAT is a hack, not a security feature, and IPv6 removes the need for it. The firewall is the security feature. (edit: the firewall on the router)
The firewall is the security feature.
Mmm whole new class of bugs and vulns being introduced in one statement.
Now my 3d printer needs its firewall babysat. So does my smart fan. Excellent idea.
Homes and businesses should be islands.
The firewall is on the router.
facepalm
yes, that’s my point, because the devices can’t be trusted to firewall themselves.
I still don’t understand your point. With a firewall on the router, there’s no difference between IPv4 and IPv6. Both are firewalled at the router. Where are the “bugs and vulns”?
If you mean my original point of the firewall not being enabled by default, I haven’t seen that recently. It was a problem historically.
You can have IPv6 on your router, and an isolated network. It’s just not necessarily what’s done by default.
yaaay so the default is my 2030 smart toaster is gonna be on a botnet
NAT is a blessing protecting the consumer from neglegent manufacturers
Having a default firewall is also a blessing, which all good routers should do. NAT is a curse.
Synology support has told me to do equally dumb shit back when I still had synology products.
It reads like: after someone deliberately configured their mac to expose a feature on the internet, someone “may” use it.
It’s probably one of those “security issue found by AI”.
Apparently requires VNC to be open to the internet
So if requires full access to your PC from the internet to have full access to your PC?
Honest question: who still uses VNC? I think it’s only relevant because it’s just kind of a safe fallback but not because it’s particularly great at anything.
The underlying protocol (RFB) is very simple to implement, and in fact some friends and I implemented both a VNC client and server as part of a project we worked on at university nearly 20 years ago.
Because of this, it’s common to find it in various places, especially for interacting with systems that don’t have an OS installed yet:
Most good VPS providers provide VNC access so you can set up your own OS from an ISO, use Clonezilla to clone the drive over the network, recover files if the drive gets corrupted somehow, etc. It’s a built-in feature of KVM/libvirt that the providers usually expose using something like NoVNC in their control panel. The common off-the-shelf control panels (Virtualizor, SolusVM, Virtfusion, Proxmox, etc) all have it as a standard feature.
A lot of IPMI/BMC and KVM-over-IP systems use VNC too, for a similar purpose, just for physical hardware rather than VMs. The protocol being very simple makes it easy to build a simple version into an embedded system. This is also usually accessed via NoVNC in a web UI.
I’ve been in the cloud space so long that I’m like “vnc what the fuuuuck” while I dick about with cloudinit
I don’t trust the prebuilt images that providers provide so I like installing from my own ISO.
cloud-init is useful sometimes, but I recently had an issue with Alpine’s alternative implementation (tiny-init) where it was setting a root password I didn’t know. It was pulling it from some sort of metadata, but there was nowhere in my provider’s control panel to set the default root password. Alpine also doesn’t have any documentation about how to disable tiny-init, so I had to read the code and figure it out myself (create a file called
/etc/tiny-cloud.disabledbeforeinitruns).cloud-init also can’t configure LUKS encryption. I know its usefulness is limited on a VM (since the provider can snapshot the memory and retrieve the encryption key that way), but it’s still useful when the VM isn’t running or if you stop using that provider to ensure they can’t recover the data, and it’s required in some cases (eg Plaid required me to certify that all data is encrypted at-rest before they gave me access to their API)
If its not on-prem assume the CIA can read it.
These aren’t systems for secrets, its for boring business software so I just don’t care.
It’s built into every Mac
https://support.apple.com/en-us/103229#%3A~%3Atext=Sharing%2C+Printer+Discovery-%2C5900%2C-TCP
I know, but I’ve never seen anyone use it. People use rustdesk or something like that anymore.
I use it for a headless Mac mini, otherwise yeah better solutions exist
Vnc actually works great on Mac’s. Every other device I’ve tried it on? Awful, painfully slow. But whatever Apple has done to make it not a slow POS makes it just as good as RDP or other alternatives.
