Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

Of the hundreds of support requests I've responded to post-attack, all except one attack was carried out over TeamViewer.

A tech support scam attacker would have many first-time connections to many other first-time TeamViewer users who are generally seniors instructed to run the TeamViewer app over the phone. While they may use a pool of computers/TeamViewer IDs, and a pool of IPs, there's limits to the cost-effectiveness of scaling that variation, and a pattern should definitely be visible.

"Assuming proper rate limiting" seems like a large assumption, given that the possible attack vectors are guessing the random alphanumeric passwords and testing password dumps for account pairs from other services that work with TeamViewer.

Defaulting to accepting any connection from anywhere seems like a great example of poor security configuration by default.

View on HN

> hundreds of support requests

From your comment higher up:

> I know very few people who HAVEN'T been reached by a malicious party which uses TeamViewer as a communication medium.

Do you work in tech support, in some environment prone to these kinds of attacks (e.g., a company the attackers might target)? Otherwise, it's hard to believe we live in the same world - I've heard of these kinds of attacks but I don't think I know anyone who has experienced one.

I've provided home tech support to a large number of primarily senior citizens. But I also know lawyers, teachers, and other professionals who have fallen prey to TeamViewer-based remote support scams.

Attacks of this type on corporate targets are likely much rarer because of corporate network security devices and monitoring tools. That being said, I have heard of similar remote access tools being exploited to attack corporate networks as well.

I don't actually know if you're in SV, but I would say, I often find it hard to believe people from SV live in the same world as I do, so I can understand your query. ;) I frequently find personal experiences of other HN users very different from my own, which is why it's so key to share!

>Of the hundreds of support requests I've responded to post-attack, all except one attack was carried out over TeamViewer.

And my experiences with repeatedly calling these guys had different results, that's fine.

>A tech support scam attacker would have many first-time connections to many other first-time TeamViewer users who are generally seniors instructed to run the TeamViewer app over the phone. While they may use a pool of computers/TeamViewer IDs, and a pool of IPs, there's limits to the cost-effectiveness of scaling that variation, and a pattern should definitely be visible.

And then the scammers will just switch to VMs and socks5 proxies. (They probably already use the socks, considering they're buying them in bulk)

>"Assuming proper rate limiting" seems like a large assumption, given that the possible attack vectors are guessing the random alphanumeric passwords and testing password dumps for account pairs from other services that work with TeamViewer.

The mere fact that this all happens over the network is a plenty of ratelimiting.

>Defaulting to accepting any connection from anywhere seems like a great example of poor security configuration by default.

This specifically isn't the default though.

Reply on news.ycombinator.com