TeamViewer Hacked?

[PsychoRealm]

https://www.reddit.com/r/technology/comments/4m7ay6/teamviewer_has_been_hacked_they_are_denying/

http://www.techradar.com/news/softw...cking-claims-which-the-company-denies-1322642

http://www.zdnet.com/article/hacked-teamviewer-users-careless-in-personal-security/

Checked my logs - all is clean. Plus, I'm getting instant alerts from my Amex (the only credit card I'm using) for "card not present transaction" and nothing suspicious came through.

What I'd recommend doing is enabling two-factor authentication for TeamViewer - it will make it virtually impossible to high-jack your TeamViewer account.

 

[Cowboy Crow]

Thats a name I have not heard in forever. Thought that program died already. Always thought the company was shady one way or another really.

 

[PsychoRealm]

Thats a name I have not heard in forever. Thought that program died already. Always thought the company was shady one way or another really.

200 million of usage is "dying"? :D And it's still "allegedly". There is no solid proof that it has been hacked.

 

[Cowboy Crow]

200 million of usage is "dying"? :D And it's still "allegedly". There is no solid proof that it has been hacked.

I just haven't heard about the program in forever. And 200 seems a bit inflated what are we talking about? In a day? In its whole life time? Hacked or not, this really is not the first time the company has been in hot water for something in the past, but that was long ago in the past.

 

[PsychoRealm]

I just haven't heard about the program in forever. And 200 seems a bit inflated what are we talking about? In a day? In its whole life time? Hacked or not, this really is not the first time the company has been in hot water for something in the past, but that was long ago in the past.

200 million running instances I'd assume.

 

[chuckwagon]

https://www.reddit.com/r/technology/comments/4m7ay6/teamviewer_has_been_hacked_they_are_denying/

http://www.techradar.com/news/softw...cking-claims-which-the-company-denies-1322642

http://www.zdnet.com/article/hacked-teamviewer-users-careless-in-personal-security/

Checked my logs - all is clean. Plus, I'm getting instant alerts from my Amex (the only credit card I'm using) for "card not present transaction" and nothing suspicious came through.

What I'd recommend doing is enabling two-way authentication for TeamViewer - it will make it virtually impossible to high-jack your TeamViewer account.

I just enabled 2FA, but supposedly someone that was hacked did use 2FA.

https://twitter.com/goombamunki/status/738123872596152322

 

[PsychoRealm]

I just enabled 2FA, but supposedly someone that was hacked did use 2FA.

https://twitter.com/goombamunki/status/738123872596152322

It would be virtually impossible and it would neglect the whole purpose of 2FA. If he could provide a proof that 2FA had been enabled before the breach occurred - then there would've been something to talk about. Plus, TeamViewer definitely has this kind of info in their logs.

 

[chuckwagon]

It would be virtually impossible and it would neglect the whole purpose of 2FA. If he could provide a proof that 2FA had been enabled before the breach occurred - then there would've been something to talk about. Plus, TeamViewer definitely has this kind of info in their logs.

I am seeing now that the theory is that Teamviewers DNS servers got hacked. The attackers redirected to fake auth servers that just authenticated all the connection requests.

 

[PsychoRealm]

I am seeing now that the theory is that Teamviewers DNS servers got hacked. The attackers redirected to fake auth servers that just authenticated all the connection requests.

2FA does not live in TV infrastructure. More than that, TOTP has nothing to do with DNS servers at TV. That being said, DNS "man-in-the-middle" attack should not affect Google's TOTP service (I'm using Google Authenticator).

2FA is a simple principal: "Something you have and something you know". "Something you know" is your password, while "something you have" is your TOTP which changes every 30 seconds.

In two words - if 2FA was compromised as well in this situation - there's gonna be fucking huge shit storm.

 

[ozzeh / dave]

2FA does not live in TV infrastructure. More than that, TOTP has nothing to do with DNS servers at TV. That being said, DNS "man-in-the-middle" attack should not affect Google's TOTP service (I'm using Google Authenticator).

2FA is a simple principal: "Something you have and something you know". "Something you know" is your password, while "something you have" is your TOTP which changes every 30 seconds.

In two words - if 2FA was compromised as well in this situation - there's gonna be fucking huge shit storm.

i'd love to see that. would a be beautiful clusterfuck of a shit storm



is it bad that i find this whole thing somewhat amusing?

 

[Bottiger]

Does this affect anyone that just ran teamviewer once in portable mode?

 

[chuckwagon]

Does this affect anyone that just ran teamviewer once in portable mode?

Some people think that the attackers cracked the quick support strings. But most victims had a teamviewer account. The best judge is if you had a pwnded email as your teamviewer email.after this bullshitery I added 2FA and hardened my password. (hunter2>Hunt3r@2)
Doing both of those things wipes your connection history for some stupid reason. Wanting to harden my security should not do that...anyway Many users were finding activity originating from China.

Check C:\\Program Files(x86)\Teamviewer\connection_log.txt or a file similarly named to check connections.

If you don't have any external connections listed you are probably ok.

 

[chuckwagon]

Feedback from TV

Dear User,

Thank you for your message.

We highly appreciate the trust you place in us and respect the responsibility we have to ensure your privacy. This is why we always feel a strong need to take all necessary steps to safeguard your data.

As you have probably heard, there have been unprecedented large scale data thefts on popular social media platforms and other web service providers. Unfortunately, credentials stolen in these external breaches have been used to access TeamViewer accounts, as well as other services.

We are appalled by the behavior of cyber criminals, and are disgusted by their actions towards TeamViewer users. They have taken advantage of common use of the same account information across multiple services to cause damage.

TeamViewer has not been breached or hacked. In fact, because TeamViewer account authentication uses the Secure Remote Password protocol (SRP) – we do not store any password-equivalent data.

We are determined to continue extending our security measures for you. We do not take your trust lightly, nor do we accept any compromise on data security. Please take the following recommendations to heart:

• Protect any user account you own - whether it is with TeamViewer or any another service – by using unique and secure passwords that are frequently changed.
• Ensure you have reliable anti-malware and security solutions in place at all times.
• Enable two-factor authentication whenever possible, such as with TeamViewer.

For further security information, please visit the FAQ page on TeamViewer account security.

Our support team is happy to answer any of your potential queries at: https://www.teamviewer.com/en/support/contact/submit-a-ticket/

We recommend that if you suspect that you have been the victim of criminal activities to get in touch with your local police department, in order to report your case. This is particularly important because TeamViewer is subject to very strict data protection and privacy regulations, and can release sensitive data only to authorized individuals and authorities.

If you have any further questions, please do not hesitate to contact us again.

Best regards

Julia Mittelstädt
Support Engineer
-----------------------
TeamViewer GmbH * www.teamviewer.com

Jahnstr. 30 * D-73037 Göppingen
Tel. +49 (0)7161 60692 50 * Fax +49 (0)7161 60692 79

Handelsregister Ulm HRB 534075 * Geschäftsführer: Andreas König, Stephan Kniewasser


Ticket ID: 2548836

 

[PsychoRealm]

Feedback from TV

That actually makes sense. LasPass (which I'm also using) is utilizing SRP as well - basically, your master password is encrypted at local workstation and LastPass has no key to decrypt it. That being said, even if LastPass was hacked - cyber criminals would take no advantage of master passwords since all they could get would be encrypted strings.

1. People are lazy so they use the same username and password for all sites - financial, social, etc.
2. People are cheap so they don't want to pay for Vaults (like LastPass) and store their passwords encrypted and use password generator (like I do - I have 12 character auto-generated password for each of my accounts).

Result - once you get someone's password for Facebook you most likely can use this person's online banking because there is a pretty high possibility that credentials would be the same.

Oh well, tough shit.