Apple’s Built‑in Screen Sharing Relies on Unencrypted VNC, Exposing macOS Devices to Credential Capture
What Happened — Apple’s native Screen Sharing feature still uses the legacy VNC protocol, which transmits data in clear‑text over TCP 5900 and authenticates with a single, static password. The protocol itself has not been hardened or encrypted by Apple.
Why It Matters for Compliance & Audit Readiness
- SOC 2’s CC6.1 (Encryption in Transit) requires that remote access channels be protected; an unencrypted VNC stream fails this control.
- CC6.2 (Authentication) expects strong, multi‑factor authentication; a global password is a control gap that auditors will flag.
- Continuous‑control monitoring can surface such legacy services in real time, providing defensible evidence that the organization has remediated the gap.
Who Is Affected — Enterprises that enable macOS Screen Sharing for remote support, education institutions with Mac labs, and any organization with Apple devices on internal networks.
Recommended Actions
- Disable the built‑in Screen Sharing service where not required.
- If remote display is needed, enforce an encrypted tunnel (e.g., SSH or VPN) and replace the static password with per‑user credentials and MFA.
- Log all VNC connections and feed those logs into your continuous‑compliance platform to map against SOC 2 CC6.1/CC6.2.
- Document the remediation in your control evidence repository to demonstrate audit readiness.
Source: SANS Internet Storm Center
Technical Notes
- Protocol: VNC (Remote Framebuffer) over TCP 5900, no native encryption.
- Authentication: legacy global password, no MFA.
- No CVE; the issue is architectural – a legacy protocol left unchanged.
Source: SANS Internet Storm Center