Comment by ocdtrekkie | Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

I honestly feel that as much of a fan of TeamViewer I was in the past, it should be considered harmful and filtered out by ISPs and flagged by AV.

- TeamViewer has been the primary medium for tech support scams that lock people out of their own PCs for years now. Despite a usage pattern that should be easy to detect, they've seemingly done nothing effective to curb this.

- TeamViewer is blaming insecure configuration, which is probably mostly true, but TeamViewer has refused to do much to encourage or ensure security practices are upheld. (Random six character passwords on by default?)

- TeamViewer has clearly failed to police large scale attempts to test credentials against their server, if they're using password dumps to find people using the same password elsewhere, as many people on Reddit confirmed was likely the case for them.

I strongly suspect the majority of free service TeamViewer usage is currently malicious. I know very few people who HAVEN'T been reached by a malicious party which uses TeamViewer as a communication medium.

I've personally called and asked TeamViewer to consider shuttering their free service to control malicious use. They could introduce an affordable personal use paid tier instead, which would make them a lot of money, and mitigate most abuse cases.

>- TeamViewer has been the primary medium for tech support scams that lock people out of their own PCs for years now. Despite a usage pattern that should be easy to detect, they've seemingly done nothing effective to curb this.

Yes, and they also use join.me and logmein. And with 0 user feedback it's hardly an easy to detect usage pattern.

>- TeamViewer is blaming insecure configuration, which is probably mostly true, but TeamViewer has refused to do much to encourage or ensure security practices are upheld. (Random six character passwords on by default?)

AFAIK by default it requires you to accept any incoming connections, and a random six character alphanumeric pass should be quite sufficient assuming proper ratelimiting. 2238976116 attempts without uppercase and 57731386986 with uppercase letters included isn't gonna happen very fast over the network.

>- TeamViewer has clearly failed to police large scale attempts to test credentials against their server, if they're using password dumps to find people using the same password elsewhere, as many people on Reddit confirmed was likely the case for them.

We really don't know. Reddit speculation isn't very useful as mostly everyone will be in those dumps.

Of the hundreds of support requests I've responded to post-attack, all except one attack was carried out over TeamViewer.

A tech support scam attacker would have many first-time connections to many other first-time TeamViewer users who are generally seniors instructed to run the TeamViewer app over the phone. While they may use a pool of computers/TeamViewer IDs, and a pool of IPs, there's limits to the cost-effectiveness of scaling that variation, and a pattern should definitely be visible.

"Assuming proper rate limiting" seems like a large assumption, given that the possible attack vectors are guessing the random alphanumeric passwords and testing password dumps for account pairs from other services that work with TeamViewer.

Defaulting to accepting any connection from anywhere seems like a great example of poor security configuration by default.

>Of the hundreds of support requests I've responded to post-attack, all except one attack was carried out over TeamViewer.

And my experiences with repeatedly calling these guys had different results, that's fine.

>A tech support scam attacker would have many first-time connections to many other first-time TeamViewer users who are generally seniors instructed to run the TeamViewer app over the phone. While they may use a pool of computers/TeamViewer IDs, and a pool of IPs, there's limits to the cost-effectiveness of scaling that variation, and a pattern should definitely be visible.

And then the scammers will just switch to VMs and socks5 proxies. (They probably already use the socks, considering they're buying them in bulk)

>"Assuming proper rate limiting" seems like a large assumption, given that the possible attack vectors are guessing the random alphanumeric passwords and testing password dumps for account pairs from other services that work with TeamViewer.

The mere fact that this all happens over the network is a plenty of ratelimiting.

>Defaulting to accepting any connection from anywhere seems like a great example of poor security configuration by default.

This specifically isn't the default though.

> hundreds of support requests

From your comment higher up:

> I know very few people who HAVEN'T been reached by a malicious party which uses TeamViewer as a communication medium.

Do you work in tech support, in some environment prone to these kinds of attacks (e.g., a company the attackers might target)? Otherwise, it's hard to believe we live in the same world - I've heard of these kinds of attacks but I don't think I know anyone who has experienced one.

I've provided home tech support to a large number of primarily senior citizens. But I also know lawyers, teachers, and other professionals who have fallen prey to TeamViewer-based remote support scams.

Attacks of this type on corporate targets are likely much rarer because of corporate network security devices and monitoring tools. That being said, I have heard of similar remote access tools being exploited to attack corporate networks as well.

I don't actually know if you're in SV, but I would say, I often find it hard to believe people from SV live in the same world as I do, so I can understand your query. ;) I frequently find personal experiences of other HN users very different from my own, which is why it's so key to share!

In the Windows world, 10 specifically, is there a way to blacklist the sites so regardless of browser my parents cannot get to this kind of software?

Unfortunately, one of TeamViewer's best features is how easily it works without firewall configuration. Often you can use it in schools and corporate environments. It is likely at least a little irritating to successfully block.

I found this (older) link, which seems to provide an IP range to block, and of course, suggests blocking TeamViewer DNS entries. But I'm not sure how good a block you'll manage on a Windows PC as opposed to a network device of some flavor.

http://mediarealm.com.au/articles/2014/10/block-teamviewer-n...

The easiest way to restrict the damage your parents can do to themselves is to make a separate admin user, and make them not an admin. Of course, then you volunteer yourself to install stuff for them too.

An easy way would be to route teamviewer's site to 127.0.0.1 in the hosts file, but that isn't fool proof.

Reply on news.ycombinator.com