HNHacker News
TopNewBestAskShowJobs

6f

323 karma · joined July 20, 2022

submissionscomments
6f··on TeamViewer installs suspicious font only useful for web fingerprinting
The font is used by the teamviewer website. When inviting a partner to a teamviewer session, one can do so by sharing the invitation url.

The invitation url looks like this (where XXXXXXXX is the session code).

  https://get.teamviewer.com/v15/en/sXXXXXXXX
The website will check if a teamviewer font is installed (using javascript). If the font is found, the web site assumes that teamviewer is installed. The teamviewer installer also registers a protocol handler in the operating system. The website (javascript code) will thus try to launch teamviewer directly using a url like the following:

  teamviewer8://instantsupport/?sid=XXXXXXXX
Otherwise, if the font is not found, it will prompt the user to download and install the teamviewer application.

Source: Font detection routine:

  https://get.teamviewer.com/get/res/scripts/fontdetect.js
Connect routine:

  https://get.teamviewer.com/get/res/scripts/connect.js