Penetration Test Report (FalanxCyberDefence): realvnc penetration test

VNC Connect security whitepaper
Penetration test report and response
This document describes RealVNC’s response to a penetration test report
conducted by an independent security agency, Falanx Cyber Defence
Version 1.0
Penetration test report and response
RealVNC response to the report
Our customers’ privacy is of paramount importance to RealVNC. As such, our flagship VNC Connect remote access
software is built from the ground up with security and compliance in mind. We understand that our online infrastructure,
website and the software itself must adhere to the highest security standards, and must remain ahead of the curve as
active security threats emerge.
In March 2018, we contracted Falanx Cyber Defence (FCD), an independent security agency, to test our infrastructure
and produce an objective penetration test report. FCD praised RealVNC’s security as at a ‘high level’. This document
addresses the two potential issues uncovered in their report, which can be found appended to this document.
To learn more about VNC Connect security and compliance, visit our dedicated security page. If you have any further
questions, please do not hesitate to contact us at enquiries@realvnc.com or via realvnc.com/contact-us.
Web application password policy (medium risk)
The report identified our web application password policy as ‘medium risk’:
“The medium risk finding was related to the web application password policy that was in place. It was identified that the
only control on a user’s password was the length must be a minimum of 8 characters. No complexity rules or specific
character combinations were enforced resulting in a password policy that would be susceptible to a brute force attack.
This finding can be remediated by adhering to the advice provided in the findings section.” (Page 5)
VNC Connect users must sign up for a RealVNC account online. This sign up process follows NIST guidelines rather
than OWASP guidelines. They are equally secure, but FCD favors the OWASP guidelines.
NIST guidelines make the password-creation process as user friendly as possible. Passwords must be at least eight
characters long, but composition rules (having to include a combination of lower/upper case letters and numbers) are
not required. NIST found that the supposed increase in complexity this affords is actually illusory (research shows that
many people simply create an easy-to-guess password such as Pa55w*rd).
Providing a VNC Connect user follows our recommended password guidelines (not sharing the password with another
online account or service), our NIST-based web application password policy is not a security threat. Note also we
recommend that users turn on two factor authentication to protect against compromised or phished passwords.
Information disclosure (low risk)
The report identified the following as ‘low risk’:
“The low risk finding was related to several misconfigurations which resulted in information disclosure. A robots.txt file
and a server version were exposed; both could allow an attacker to get a better idea of the applications structure and
identify possible vulnerabilities related to the server details. This finding can be remediated by ensuring that all
information externally available is reviewed for a business purpose and made as generic as possible.” (Page 5)
Two potential problems are identified here:
 The robots.txt file is exposed
This file directs web crawling bots. Since this file contains no sensitive information or links to undocumented web
pages, it has not been removed.
 The default apache file is exposed
This file has been removed (although in any case it did not contain sensitive information).
2
RealVNC’s remote access and management software is used by hundreds of millions of people worldwide in every
sector of industry, government and education. Our software helps organizations cut costs and improve the quality of
supporting remote computers and applications. RealVNC is the original developer of VNC remote access software and
supports an unrivalled mix of desktop and mobile platforms. Using our software SDKs, third-party technology
companies also embed remote access technology direct into their products through OEM agreements.
Copyright © RealVNC Limited 2018. RealVNC and VNC are trademarks of RealVNC Limited and are protected by
trademark registrations and/or pending trademark applications in the European Union, United States of America and
other jurisdictions. Other trademarks are the property of their respective owners. Protected by UK patents 2481870,
2491657; US patents 8760366, 9137657; EU patent 2652951. 05Apr18
www.realvnc.com
RealVNC
RealVNC Penetration Test
COMMERCIAL IN CONFIDENCE
14/02/2018
1.0
Gordon Smith
Security Consultant
RealVNC
Contents
DOCUMENT CONTROL ......................................................................................................................................................................................................................................................... 3
Version History...................................................................................................................................................................................................................................................................... 3
EXECUTIVE SUMMARY ........................................................................................................................................................................................................................................................ 3
Objective ...................................................................................................................................................................................................................................................................................... 3
Background ............................................................................................................................................................................................................................................................................... 3
Summary of Findings ...................................................................................................................................................................................................................................................... 4
Findings Analysis ................................................................................................................................................................................................................................................................. 5
Approach ...................................................................................................................................................................................................................................................................................... 6
Severity Level Description ................................................................................................................................................................................................................................................ 7
Remediation Checklist ........................................................................................................................................................................................................................................................... 8
Application Penetration Testing ......................................................................................................................................................................................................................... 8
DETAILED FINDINGS – WEB APPLICATION ..................................................................................................................................................................................