📸 Photo

EXPOSURE

153

It had started in June 2006, when a serious security hole emerged in the software RealVNC, for "virtual network console"—a remote-control program used to administer Windows machines over the Internet.

The bug was in the brief handshake sequence that opens every new session between a VNC client and the RealVNC server. A crucial part of the handshake comes when the server and client negotiate the type of security to apply to the session. It's a two-step process: First, the RealVNC server sends the client a shorthand list of the security protocols the server is configured to support. The list is just an array of numbers: [2,5], for example, means the server supports VNC's type 2 security, a relatively simple password authentication scheme, and type 5, a fully encrypted connection.

In the second step, the client tells the server which of the offered security protocols it wants to use by sending back its corresponding number, like ordering Chinese food off a menu.

The problem was, RealVNC didn't check the response from the client to see if it was on the menu in the first place. The client could send back any security type, even one the server hadn't offered, and the server unquestioningly accepted it. That included type 1, which is almost never offered, because type 1 is no security at all—it allows you to log in to RealVNC with no password.

It was a simple matter to modify a VNC client to always send back type 1, turning it into a skeleton key. An intruder like Max could point his hacked software at any box running the buggy RealVNC software and instantly enjoy unfettered access to the machine.

Max started scanning for vulnerable RealVNC installations as soon as he learned of this gaping hole. He watched, stunned, as the results scrolled down his screen, thousands of them: computers at homes and college dorms; machines in Western Union offices, banks, and hotel lobbies. He logged in to some at random; in one, he found himself looking at the feeds from closed-circuit video surveillance cameras in an office-building lobby. Another was a computer at a Midwest police department, where he could