topic Re: Detecting VNC without a password in Automation/API Discussions

Detecting VNC without a password

tdck63 — Fri, 23 Mar 2012 22:05:03 GMT

Has anybody tried to create a custom siganture, (or has it been discussed as a native signature by Palo Alto), for detecting a VNC session initiated without a password challenge/response? It seems like this would be a useful audit notification to protect against the everpresent layer 8 threat...

Re: Detecting VNC without a password

jseals — Fri, 23 Mar 2012 22:22:31 GMT

Hello,

This is an interesting idea. I haven't heard of anyone attempting it.

We have a forum that is more suitable for this query, I'd suggest that you post it in our DevCenter:

https://live.paloaltonetworks.com/community/devcenter

Also, you can submit this idea to our content team for them to possibly create it in the future by going to the following link:

http://www.paloaltonetworks.com/researchcenter/submit-an-application/

Thanks,

Jason Seals

Re: Detecting VNC without a password

tdck63 — Mon, 26 Mar 2012 20:56:42 GMT

Hi Jason,

Thanks for the feedback. I moved the thread to DevCenter, submitted an application request (and I also checked with Palo Alto support via the ticket system). If I find out anything else, I will post it here for reference!

Re: Detecting VNC without a password

jseals — Fri, 30 Mar 2012 01:51:14 GMT

Hi,

That sounds great. Please keep us informed.

Thanks,

Jason

Re: Detecting VNC without a password

SRA — Fri, 30 Mar 2012 02:05:18 GMT

The threat research team is investigating if this can be covered using a vulnerability signature in a future content update.