Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: VNC viewers: Clipboard of host automatically sent to remote machine
From: GloW - XD <doomxd () gmail com>
Date: Wed, 25 Jan 2012 20:32:42 +1100

you are seriously more retarded than even the n3td3v+me+you
together...damn army..!


On 25 January 2012 19:29, Peter Osterberg <j () vel nu> wrote:
Wasn't the original thread originally about VNC?

On 01/25/2012 09:27 AM, GloW - XD wrote:
derp, do you know what KVM IP is ?
readup on how that relays ;)
thats that.
XD


On 25 January 2012 18:44, Peter Osterberg <j () vel nu> wrote:
On 01/24/2012 07:18 PM, Mario Vilas wrote:
Guys, could you please read carefully everything before you reply?
I read carefully. It still didn't make sense, though.

And you wouldn't be allowed to use copy&paste while you edit sensitive
documents either, I guess?
I don't know how you could get to such a conclusion from what I wrote.

You're reporting that if you copy and paste sensitive information and
connect to a VNC session your clipboard data gets sent to the remote
machine. That's pretty obvious and not a security hole that needs to
be plugged.
I don't think that is what Ben is saying. The clipboard get sent to the
the server even before it is pasted, this happens without the user
knowing of it.

Notepad would have the paste button grayed otherwise, if the clipboard
is empty, right? So it is already on the server before paste is pressed.

So what ever was in the clipboard buffer is transmitted to the server on
connection.

This is at least the assumption I make from reading Ben's mails. Or...
Is there a cliboard flag saying there is something on the clipboard, but
it isn't transmitted until the user actually pastes? I haven't really
got any experience with how the clipboard feature is implemented. My
assumption is however that it has to be on server for notepad to be
aware that Paste shouldn't be grayed out...

I think Ben's report make complete sense actually, it would be better to
have the clipboard feature as a default. Security before features... =)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]