Slashdot Mirror
TeamViewer Denies Being Hacked, Blames Users, Introduces New Security Measures (betanews.com)
Mark Wilson writes: In the last couple of weeks there have been a huge number of reports from TeamViewer users that their computers have been hijacked. In addition to this, users of the remote access tool have complained of funds being extracted from PayPal and bank accounts. But TeamViewer insists that there has not been a security breach, instead shifting the blame to users.
The company says [users] are in the habit of reusing the same passwords for a number of apps and services. It suggests that recent high profile security breaches -- such as the password dumps from MySpace and LinkedIn -- have allowed cyber criminals to learn TeamViewer log in credentials.
"We are appalled by the behaviour of cyber criminals, and are disgusted by their actions towards TeamViewer users," reads the company's statement. But they will now notify users whenever a new device logs in to a TeamViewer account, and in the future will also require a new password whenever suspicious account activity is detected.
The company says [users] are in the habit of reusing the same passwords for a number of apps and services. It suggests that recent high profile security breaches -- such as the password dumps from MySpace and LinkedIn -- have allowed cyber criminals to learn TeamViewer log in credentials.
"We are appalled by the behaviour of cyber criminals, and are disgusted by their actions towards TeamViewer users," reads the company's statement. But they will now notify users whenever a new device logs in to a TeamViewer account, and in the future will also require a new password whenever suspicious account activity is detected.
https://news.slashdot.org/stor...
It little behooves the best of us to comment on the rest of us.
But people are reporting unique, long passwords on their TV accounts being useless. And at least one case where a person was able to login to a PC even through 2FA authentication.
Either this is just a wide configuration error in the TV client made by unknowing users, or someone is lying.
... to install TV. Great reviews. Broad support. Free. But sh~t like this always seemed a risk.
Back in February, I had Team Viewer running 24/7 on an Ubuntu Desktop. I had a "strong" password, using letters, numbers and symbols. I was at a customer site installing a new Asterisk phone system and suddenly I get notifications from Paypal that I'm buying large amounts of virtual currency with NCSoft. It took me all of 5 minutes to realize what was happening and change my Paypal password and in that time, several grand was spent. It took me a week to get it all fixed, which isn't that bad.
Team Viewer Support couldn't care less. I asked why they wouldn't even notify on an account that's never been accessed from outside the country and they had no answers. Now, what could I have done better? Setup Multi-Factor Authentication for Team Viewer and Paypal. So, some of the responsibility is mine. However, I find it very strange that someone could have hacked or guessed that account's password. I asked if they had a breach and they reported that there were no problems, of course. Notification and confirmation of suspicious activity should have been implemented by them a long time ago.
https://www.reddit.com/r/teamviewer
Consider how many people use auto-login for all sorts of things in their web browser. If you can log in to their system as their user, and access their web browser, you will almost certainly be able to access some of their accounts. No amount of teamviewer security can offset user laziness.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
The fact that they allow users to download old versions of TeamViewer is 1/2 the problem. I entertained a call from someone who was likely Pakistani that asked me to install an old version of TeamViewer from their website. Though I got on Linux and tried to follow their instructions...they didn't know what Linux was. I succeeded in wasting 30 minutes of their time.
Chrome TV plugin asinine defaults to allow remote without password. Add to that plugin installs are synced you could have TV installed on a pc without realising it. Defaulting to *allow* remote access.
I work for a small IT shop/MSP. We use logic now/GFI tools to manage machines. The bukt in remote tool is called TakeControl, but is simply a slightly modified TeamViewer. The client and board backend negotiate a regularly changing passphrase for remote access, it is out of user control. The rest of the protocol and software is the same.
We have not yet had a single one of our managed PCs or servers report any activity like this. If there was a breach at Teamviewer, Takecontrol enabled computers managed by MSPs are often small/mid sized businesses and make a much juicer target. The passwords to connect to these machines would exist in teamviewers infrastructure the same as anyone elses.
Silence is a state of mime.
At least some "stupid-mitigiation" could have helped.
Things like two factor auth (user still uses stupid password, but also needs token given by smart-phone app, or recieved by 2nd channel)
Or things like public-key authentication (stupid password is used to unlock locally stored file with cryptographic key. Key is only used to sign stuff over wire)
In both case, even in the case of a massive leak (e.g.: like recent LinkedIn's) the stolen passwords can't be used alone to impersonate user identity.
(either an extra token would be needed in addition. Or a file containing the cryptographic key. Both of which stay in the possession of the end-user and never travel the wire).
But no, companies still continue to recommend "secure" passwords.
(Which can still be mitigiated using a decent password manager).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I'm not buying Team Viewers explaination one bit. I know the individual in this article. He's a fellow security expert with whom I've worked. He's no security slouch, quite the opposite in fact. He caught the attackers in the act (yeah, he got lucky there) and took action as it unfolded before his eyes. Team Viewer has some serious 'splainen to do...
https://securityintelligence.c...
Are there any free (libre) alternatives to Team viewer?
dont leave team viewer running unless you plain on using it your just leaving a door open. just like any other vnc. dont let anyone in with any 3rd party app unless you trust them. tech support of any kind will never cold call you. its very simple things hear and you will have no problems.
It will give you a remote session. Provided:
- You open a hole in your firewall
- You have a dynamic DNS service
- You don't mind sending username/password, and your entire session in the clear
- You don't mind the performance
These issues are amplified if you're helping somebody over the phone.
As far as I know, there are no free (libre) alternatives to Teamviewer.
There are hundreds of millions of username/password combinations, stolen from lots of different websites that have been breached over the years. A person(s) or group(s) with this collection decides to target teamviewer users, especially after learning that teamviewer doesn't require their users to enable 2FA. Of course, 99.99% of all the accounts in the huge list will fail (user doesn't exist, wrong password, etc.). But, it doesn't cost any money to continually bang on teamviewer servers looking for username/password combos that work - this part is automated and being done from thousands of computers all at the same time (essentially a botnet). They take the list of successful user/pass combos and give it to a group of people determined to transfer paypal, buy gift cards, anything that will let them infiltrate money by taking control of that user account.
Who is at fault? Teamviewer doesn't deserve to walk from this completely free of blame. They should have required 2FA for accounts that allow for remote session activity. In addition, they should have noticed huge spikes of bad user/pass combos being tried on their servers.
Unfortunately, the majority of the blame lay with poor security decisions made by users. Any critical account (like remote access or anything related to money) should be protected by a unique strong password and 2FA (when available).
This is just the beginning folks. We're going to see more and more of these types of attacks.
How so? I haven't had any issues with it myself. I log in from an unknown computer and get prompted for the code sitting in Google Authenticator. Am I missing something?