9 ms·
TeamViewer denies hack after PCs hijacked, PayPal accounts drained
- lazzlazzlazz 10y agoI got hit by this. I had an incredibly long, TeamViewer-specific password, and a family member happened to witness (what was likely a bot) incredibly quickly open Chrome, go to Paypal, login using saved credentials, check the settings page, and then pay an invoice that had been generated moments after viewing the settings page. TeamViewer has definitely been compromised, and reddit.com/r/teamviewer is replete with reports.
- ryanlol 10y agoNah, you got hit by some malware that grabbed your teamviewer credentials.
- Devagamster 10y agoIf so it must have been an extremely wide spread malware because tons of people have been reporting the same thing.
- ryanlol 10y agoNot really, "tons" in this case isn't even hundreds.
- gruez 10y agoNot everyone affected is going to post on reddit. There are plenty of tech-iliterate victims who don't even know something is wrong.
- ryanl0l 10y agoI'm aware. But even tens of thousands of affected people wouldn't qualify as "an extremely wide spread malware". If you spin up an exploit pack and can't get 50k hits in a day you're clueless and should consider a career outside of cybercrime.
- ryanlol 10y agoTo expand on this further, most (i.e. not all) of the reddit reports are meaningless as on any given day there's going to be tens of thousands of examples of this kind of fraud. Unless the reporters have some specific evidence that teamviewer is at fault, it's overwhelmingly likely that many of them were hit by some totally unrelated fraud.
- Buge 10y agoWell it's related to Teamviewer for sure, because it shows up in the people's Teamviewer connection logs. Yeah it could be other malware that is stealing the Teamviewer credentials from their computer. But that seems like more work than necessary, because only a few percent of people have teamviewer installed and running, and they could attack everyone by having them malware install their own remote access service. This person formatted the drive a week ago and only had a few things installed. https://www.reddit.com/r/teamviewer/comments/4jr9qn/hacked_trough_teamviewer_1800_spent_on_paypal/ https://www.reddit.com/r/teamviewer/comments/4jr9qn/hacked_t...
- hackney 10y agoIt may well be a legitimate hack of TV but from a very small pool of thieves.
- ocdtrekkie 10y agoDo you have the randomly generated password disabled?
- cpncrunch 10y agoWhy did you let Chrome save your paypal password? Doesn't that guarantee that anyone can empty your paypal account if they steal your computer?
- ryanl0l 10y agoWhy would you care? You can call in and reverse the payment in minutes.
- cpncrunch 10y agoYes, I just had a look at paypal's user agreement, and this does seem to be the case. That begs the question - why are the hackers even bothering to do this, if all their transactions will be cancelled? Are they hoping that a small % of their victims won't notice the fraudulent transactions?
- ryanl0l 10y agoMost paypal fraud, like credit card fraud happens at a very small scale. A fraudster pays $50 for 50 accounts and then spends a day with them and maybe walks out with $300. The guy selling the accounts sells hundreds of thousands of them, and obviously doesn't get involved in the fraud itself. This is why this whole thing is so strange, there's a bunch of people claiming that someone hacked teamviewer and is now using that access for petty paypal fraud instead of targetting the tens (if not hundreds) of thousands of PoS systems teamviewer is used to manage. >Are they hoping that a small % of their victims won't notice the fraudulent transactions? No, they certainly don't care if the payments get charged back or not. If they try to send money to their own account, it'll be suspended before they can actually withdraw it out of PayPal. Instead in this case they seem to be trying to buy itunes gift cards, undoubtedly with the intent to sell them (on sites such as g2a.com) before they get cancelled.
- lsaferite 10y agoPerhaps targeting a PoS system involves the Secret Service?
- jdhawk 10y agoI got hit as well, along with a family members computer who was logged into my account. They hit up amazon and PayPal on the other computer due to saved passwords.
- wslh 10y agoTwo factor authentication is the way to go to mitigate these kind of attacks.
- koolba 10y agoWhy do you have remote access set up to a computer that has unencrypted credentials stored on it?
- Buge 10y agoBecause it's useful? Tons of people have ssh set up to their servers. Many of those servers might contain api keys for various services. Same thing.
- Killah911 10y agoI got hit with this too. TeamViewer showed incoming connections from Taipei & Guangzou. What I'm interested in figuring out is how sophisticated the attackers were. I immediately took the breached machine offline & plan on scanning it for negligees etc. I called TeamViewer & their response neither acknowledged or denied the hack. They simply asked me to report to local authorities & promised that they'd be cooperative with lots/etc.
- cs702 10y agoShame on TeamViewer for not coming clean. I doubt they will survive the reputational damage. The hacking itself should not be surprising. Roughly 99.99% of human beings -- including the vast majority of software developers -- have NO IDEA how to secure a computing device, let alone one that can be accessed remotely by regular people. It's kind of incredible that this type of attack doesn't happen more frequently. The post-mortem should be quite interesting.
- LeoPanthera 10y agoAlternatives to TeamViewer?
- gruez 10y agoRDP(no additional install needed) or anydesk(low latency codec)
- ocdtrekkie 10y agoRDP for wide Internet use is a sketchy choice, IMHO. Configuration is a pain, particularly if you live in DHCP land like most home users. It doesn't perform very well in that environment from my experience either.
- JonathonW 10y agoIME RDP performance is fine these days if you've got even a halfway decent upstream connection-- the newer clients and servers are much better about tolerating low bandwidth/high latency connections than they used to be (they finally ditched the naive "forward the GDI calls" approach they used to take and do lossy compression much like VNC now). I don't expose it to the internet, though. Only thing on my home network that is exposed directly to the internet is an SSH gateway (using public key auth, passwords disabled); from there, I can forward SSH or VNC or whatever I need access to.
- ryanl0l 10y agoRDP at home is certainly difficult, but I have to disagree on the performance bit. In fact, RDP is probably by far the best such protocol in use right now.
- jsutton 10y agoLogMeIn
- darkr 10y agoExpensive (nearly £1k/agent/year) and afaik only works on Windows (for the agent viewer)
- galadran 10y agoFrom looking at the Reddit "master thread", everybody reporting they were hacked reports 2FA disabled. Everybody reporting no hack reports 2FA enabled. Sounds like reused passwords!
- jessaustin 10y agoTFA has 2FA hacks: "They remote connected in at 5AM MT, went into my Chrome and used my PayPal to buy about $3k worth of gift cards. And yes, I had two-factor authentication."
- ryanl0l 10y agoOn paypal or TV? Needs clarification.
- jessaustin 10y agoTFA also has: Yet, we've heard from people who have used passwords unique to TeamViewer, who have enabled two-factor authentication, and have found no malware on their computers, losing control of their systems in the past few days via TeamViewer. Apparently TV disagrees, but in this case I'm inclined to believe their unfortunate users.
- colemickens 10y agoHow could that even be possible? Short of PayPal having a hole in their 2FA implementation, it's very difficult for me to imagine how this could happen. I mean, unless the hackers logged in, left the 2FA prompt up and then a user completed the 2FA exchange, but that would be a foolish thing to do anyway... edit: thanks for the answers; makes sense!
- ryanlol 10y agoPresumably the 2fa is just for the login, and the user would already be logged into paypal on their computer. Your paypal account getting hacked isn't a Big Deal, you aren't going to lose any money over it. In fact, managing that is paypals entire business model.
- ocdtrekkie 10y agoI honestly feel that as much of a fan of TeamViewer I was in the past, it should be considered harmful and filtered out by ISPs and flagged by AV. - TeamViewer has been the primary medium for tech support scams that lock people out of their own PCs for years now. Despite a usage pattern that should be easy to detect, they've seemingly done nothing effective to curb this. - TeamViewer is blaming insecure configuration, which is probably mostly true, but TeamViewer has refused to do much to encourage or ensure security practices are upheld. (Random six character passwords on by default?) - TeamViewer has clearly failed to police large scale attempts to test credentials against their server, if they're using password dumps to find people using the same password elsewhere, as many people on Reddit confirmed was likely the case for them. I strongly suspect the majority of free service TeamViewer usage is currently malicious. I know very few people who HAVEN'T been reached by a malicious party which uses TeamViewer as a communication medium. I've personally called and asked TeamViewer to consider shuttering their free service to control malicious use. They could introduce an affordable personal use paid tier instead, which would make them a lot of money, and mitigate most abuse cases.
- ryanlol 10y ago>- TeamViewer has been the primary medium for tech support scams that lock people out of their own PCs for years now. Despite a usage pattern that should be easy to detect, they've seemingly done nothing effective to curb this. Yes, and they also use join.me and logmein. And with 0 user feedback it's hardly an easy to detect usage pattern. >- TeamViewer is blaming insecure configuration, which is probably mostly true, but TeamViewer has refused to do much to encourage or ensure security practices are upheld. (Random six character passwords on by default?) AFAIK by default it requires you to accept any incoming connections, and a random six character alphanumeric pass should be quite sufficient assuming proper ratelimiting. 2238976116 attempts without uppercase and 57731386986 with uppercase letters included isn't gonna happen very fast over the network. >- TeamViewer has clearly failed to police large scale attempts to test credentials against their server, if they're using password dumps to find people using the same password elsewhere, as many people on Reddit confirmed was likely the case for them. We really don't know. Reddit speculation isn't very useful as mostly everyone will be in those dumps.
- tlrobinson 10y agoIt seems kind of insane to me to trust any 3rd party with full access to your machine.
- ocdtrekkie 10y agoReally, everyone with any software with administrative rights that has an auto-update feature does it. These days, that's... Windows, Chrome, dozens of other applications with a huge market share. At least with TeamViewer, it is manual update only, and remote users only have the same permissions and visibility as a desktop user. When you access a locked Windows PC over TeamViewer, you get the Windows login screen. You only have the level of permissions your computer is allowing the user you log in as. If you lock your PC when you aren't at it, and your password is decent, you haven't a huge security problem with TeamViewer. Arguably, less of one than many other pieces of software that can make administrative-level changes to your PC without your knowledge or permission.
- hackney 10y agoIs it that TV got hacked because passwords were compromised and reused? I fail to see security in an ap that uses uknown servers to connect to a personal setup. Somehow I think TV did get hacked and they just don't want to be honest about it. ?? I've used nomachine with good results from my lan but have never used it outside that.
- tomc1985 10y ago"Little pig, little Pig, let me come in." "No, no, not by the hair on my chinny chin chin." "Then I'll huff, and I'll puff, and I'll blow your house in."
- xenadu02 10y agoHere's the thing: it simply isn't possible that TeamViewer has done a thorough security audit in such a short amount of time. That means their claims of "no breach" are knee-jerk reactions, not truthful statements. A company that has such a reaction is more likely to suffer a breach IMHO because it demonstrates a lack of knowledge, care, or both. If they were smarter they'd say they aren't aware of anything but have launched an investigation and will report back when it is complete. So I'm going to assume they have been hacked until someone proves otherwise.
- Splines 10y agoRIP TeamViewer. Unless they are extremely explicit with what happened and how it won't happen again, any user who hears about this is going to lose all trust in TeamViewer.
- jklinger410 10y agoTheir response has already lost my trust. Hope they realize they may have just sealed their own graves with their flippant handling of these claims.
- nikanj 10y agoExcept if what happened was password reuse
- thejosh 10y agoIt wasn't, people even had 2fa.
- FuckOffNeemo 10y agoxenadu02: you couldn't have said it better. I must admit, I didn't add much weight to the opinions of the vast majority on Reddit. It's less of an IT-savvy hub today than it has been in the past and I /wanted/ to believe that the issue was simple reused passwords. But from the claims made here in Hacker News (who's opinion carries much more weight than the Reddit noise). In addition to the handful of claims where logs have been presnted and users have confirmed use of MFA and complex passwords. I've sincere doubts about the credibility of TeamViewers very, very quick security audit. Edit: double copy pasta.
- fencepost 10y agoI haven't had time to follow this as much today (after spending last night either uninstalling TeamViewer or remotely disabling the TeamViewer service on a bunch of systems), but what I was reading yesterday seemed like everyone hit was using a registered account instead of just direct connections using codes. That makes me think that perhaps something's compromised some of their account information (manageable through the website, etc.) rather than the remote control infrastructure itself.
- jason_slack 10y agoand of course, nothing on their blog or main website about this. Instead they want us to focus on a work/life balance: http://imgur.com/Ujd8ZwA http://imgur.com/Ujd8ZwA
- Elrac 10y agoA couple of years ago I was looking for a remote control app to remote-multibox a couple of PCs for some online game. I found it a bit odd that every search (including for competing products) brought me to TeamViewer, that all the formerly available alternatives (like *VNC) were defunct or pay-only, and that TeamViewer was not just free but rather aggressively offered. Call me paranoid, but I thought "someone wants to make sure there's a TeamViewer on every box in the world, and is willing to pay for slick, aggressive marketing and to eat the costs of product development and marketing to see to it." My (otherwise completely unfounded) guess was that a major intelligence agency, maybe the NSA, was behind all that. I used TV for a few days but ditched it at my earliest opportunity. It just felt too creepy for me to trust it. So now, maybe, I was right for the wrong reasons. Or not. (shrug)
- nikanj 10y ago"someone wants to make sure there's a TeamViewer on every box in the world, and is willing to pay for slick, aggressive marketing and to eat the costs of product development and marketing to see to it." That would be the teamviewer company. Surprisingly often companies want their product on every desktop, and are willing to eat the marketing and development costs to make it happen.