Screen sharing security?

Question

I'd be interesting to hear thoughts on the security of the screen sharing feature of Leopard.
Is the content of the interaction protected or encrypted in any way?
How easy would it be for someone to engineer a screen sharing 'attack' on a computer (without the users consent, obviously)?

Answer 1

iChat Screen sharing requires that you Accept the call.
It also contains an Audio component so you can talk to the person involved.
As with any iChat A/V related chat it is Peer-to-Peer on a 1-1 basis.
Given that it does go through many server on the internet between you and your Buddy (like a telephone call would) it does not go through the AIM servers like a plain text chat does.
On the other hand the data is not encrypted unless you both have @mac names and IF anyone was actually at those Internet servers in between the data could be read.
However you can end a Screen Share with the keystrokes Control+Esc
From iChat Help
*About screen sharing security*
When you share your screen with a buddy, the buddy has the same access to your computer that you have. Share your screen only with trusted parties, and be particularly careful if you receive a request to share your screen from someone who isn’t in your buddy list.
If the request comes from someone in your Bonjour list, remember that the person’s name is not necessarily accurate, so his or her identity is uncertain.
While every screen sharing connection uses encryption, the highest level of security requires both participants to have .Mac accounts with encryption enabled. If this is the case, you will see a lock icon in the screen sharing window.
If you need to quickly end a screen sharing session, press Control-Escape.
Realistically it as dangerous as opening an email that you don't know the origins of and then opening a file contained in it.
I personally have not tried transferring stuff from one computer to the other.
So I don't know if there are any alerts to say a file is being sent. I would expect a progress bar at least but then again this may not be the front window.
There is/was one Virus that was in the wild for the Mac OS X.
It did involve iChat.
To get it you had to have been sent an email and open what looked like a .jpg file.
It would then spread to your other Bonjour Contacts via iChat.
i.e. you had to do quite a lot yourself to actually get this virus.
Ryan M who posts in iChat 3 posted a fix.
In terms of how secure compare it to having to login in here at Apple.
It's over the net and you have the control to end it but it is possible for people in the right place at the right time to read the data.
if you give info away about yourself here such as your ID and password then people could use that (but the login page itself is a secure page).
These questions are always hard to answer as an idea of a security risk tends to be a personal thing.
10:26 PM Wednesday; June 4, 2008