Comment by ryanlol | Hacker News Reader

Comment by ryanlol | Hacker News Reader

Parent Full thread

>- TeamViewer has been the primary medium for tech support scams that lock people out of their own PCs for years now. Despite a usage pattern that should be easy to detect, they've seemingly done nothing effective to curb this.

Yes, and they also use join.me and logmein. And with 0 user feedback it's hardly an easy to detect usage pattern.

>- TeamViewer is blaming insecure configuration, which is probably mostly true, but TeamViewer has refused to do much to encourage or ensure security practices are upheld. (Random six character passwords on by default?)

AFAIK by default it requires you to accept any incoming connections, and a random six character alphanumeric pass should be quite sufficient assuming proper ratelimiting. 2238976116 attempts without uppercase and 57731386986 with uppercase letters included isn't gonna happen very fast over the network.

>- TeamViewer has clearly failed to police large scale attempts to test credentials against their server, if they're using password dumps to find people using the same password elsewhere, as many people on Reddit confirmed was likely the case for them.

We really don't know. Reddit speculation isn't very useful as mostly everyone will be in those dumps.

Of the hundreds of support requests I've responded to post-attack, all except one attack was carried out over TeamViewer.

A tech support scam attacker would have many first-time connections to many other first-time TeamViewer users who are generally seniors instructed to run the TeamViewer app over the phone. While they may use a pool of computers/TeamViewer IDs, and a pool of IPs, there's limits to the cost-effectiveness of scaling that variation, and a pattern should definitely be visible.

"Assuming proper rate limiting" seems like a large assumption, given that the possible attack vectors are guessing the random alphanumeric passwords and testing password dumps for account pairs from other services that work with TeamViewer.

Defaulting to accepting any connection from anywhere seems like a great example of poor security configuration by default.

>Of the hundreds of support requests I've responded to post-attack, all except one attack was carried out over TeamViewer.

And my experiences with repeatedly calling these guys had different results, that's fine.

>A tech support scam attacker would have many first-time connections to many other first-time TeamViewer users who are generally seniors instructed to run the TeamViewer app over the phone. While they may use a pool of computers/TeamViewer IDs, and a pool of IPs, there's limits to the cost-effectiveness of scaling that variation, and a pattern should definitely be visible.

And then the scammers will just switch to VMs and socks5 proxies. (They probably already use the socks, considering they're buying them in bulk)

>"Assuming proper rate limiting" seems like a large assumption, given that the possible attack vectors are guessing the random alphanumeric passwords and testing password dumps for account pairs from other services that work with TeamViewer.

The mere fact that this all happens over the network is a plenty of ratelimiting.

>Defaulting to accepting any connection from anywhere seems like a great example of poor security configuration by default.

This specifically isn't the default though.

> hundreds of support requests

From your comment higher up:

> I know very few people who HAVEN'T been reached by a malicious party which uses TeamViewer as a communication medium.

Do you work in tech support, in some environment prone to these kinds of attacks (e.g., a company the attackers might target)? Otherwise, it's hard to believe we live in the same world - I've heard of these kinds of attacks but I don't think I know anyone who has experienced one.

I've provided home tech support to a large number of primarily senior citizens. But I also know lawyers, teachers, and other professionals who have fallen prey to TeamViewer-based remote support scams.

Attacks of this type on corporate targets are likely much rarer because of corporate network security devices and monitoring tools. That being said, I have heard of similar remote access tools being exploited to attack corporate networks as well.

I don't actually know if you're in SV, but I would say, I often find it hard to believe people from SV live in the same world as I do, so I can understand your query. ;) I frequently find personal experiences of other HN users very different from my own, which is why it's so key to share!

Reply on news.ycombinator.com