5 ms·

I got hit by this. I had an incredibly long, TeamViewer-specific password, and a family member happened to witness (what was likely a bot) incredibly quickly op

I got hit by this. I had an incredibly long, TeamViewer-specific password, and a family member happened to witness (what was likely a bot) incredibly quickly open Chrome, go to Paypal, login using saved credentials, check the settings page, and then pay an invoice that had been generated moments after viewing the settings page. TeamViewer has definitely been compromised, and reddit.com/r/teamviewer is replete with reports.

ryanlol 10y ago
Nah, you got hit by some malware that grabbed your teamviewer credentials.
- Devagamster 10y ago
  If so it must have been an extremely wide spread malware because tons of people have been reporting the same thing.
  - ryanlol 10y ago
    Not really, "tons" in this case isn't even hundreds.
    - gruez 10y ago
      Not everyone affected is going to post on reddit. There are plenty of tech-iliterate victims who don't even know something is wrong.
      - ryanl0l 10y ago
        I'm aware. But even tens of thousands of affected people wouldn't qualify as "an extremely wide spread malware". If you spin up an exploit pack and can't get 50k hits in a day you're clueless and should consider a career outside of cybercrime.
        ryanlol 10y ago
        To expand on this further, most (i.e. not all) of the reddit reports are meaningless as on any given day there's going to be tens of thousands of examples of this kind of fraud. Unless the reporters have some specific evidence that teamviewer is at fault, it's overwhelmingly likely that many of them were hit by some totally unrelated fraud.
        Buge 10y ago
        Well it's related to Teamviewer for sure, because it shows up in the people's Teamviewer connection logs. Yeah it could be other malware that is stealing the Teamviewer credentials from their computer. But that seems like more work than necessary, because only a few percent of people have teamviewer installed and running, and they could attack everyone by having them malware install their own remote access service. This person formatted the drive a week ago and only had a few things installed. https://www.reddit.com/r/teamviewer/comments/4jr9qn/hacked_trough_teamviewer_1800_spent_on_paypal/ https://www.reddit.com/r/teamviewer/comments/4jr9qn/hacked_t...
        hackney 10y ago
        It may well be a legitimate hack of TV but from a very small pool of thieves.
ocdtrekkie 10y ago
Do you have the randomly generated password disabled?
cpncrunch 10y ago
Why did you let Chrome save your paypal password? Doesn't that guarantee that anyone can empty your paypal account if they steal your computer?
- ryanl0l 10y ago
  Why would you care? You can call in and reverse the payment in minutes.
  - cpncrunch 10y ago
    Yes, I just had a look at paypal's user agreement, and this does seem to be the case. That begs the question - why are the hackers even bothering to do this, if all their transactions will be cancelled? Are they hoping that a small % of their victims won't notice the fraudulent transactions?
    - ryanl0l 10y ago
      Most paypal fraud, like credit card fraud happens at a very small scale. A fraudster pays $50 for 50 accounts and then spends a day with them and maybe walks out with $300. The guy selling the accounts sells hundreds of thousands of them, and obviously doesn't get involved in the fraud itself. This is why this whole thing is so strange, there's a bunch of people claiming that someone hacked teamviewer and is now using that access for petty paypal fraud instead of targetting the tens (if not hundreds) of thousands of PoS systems teamviewer is used to manage. >Are they hoping that a small % of their victims won't notice the fraudulent transactions? No, they certainly don't care if the payments get charged back or not. If they try to send money to their own account, it'll be suspended before they can actually withdraw it out of PayPal. Instead in this case they seem to be trying to buy itunes gift cards, undoubtedly with the intent to sell them (on sites such as g2a.com) before they get cancelled.
      - lsaferite 10y ago
        Perhaps targeting a PoS system involves the Secret Service?
jdhawk 10y ago
I got hit as well, along with a family members computer who was logged into my account. They hit up amazon and PayPal on the other computer due to saved passwords.
wslh 10y ago
Two factor authentication is the way to go to mitigate these kind of attacks.
koolba 10y ago
Why do you have remote access set up to a computer that has unencrypted credentials stored on it?
- Buge 10y ago
  Because it's useful? Tons of people have ssh set up to their servers. Many of those servers might contain api keys for various services. Same thing.
Killah911 10y ago
I got hit with this too. TeamViewer showed incoming connections from Taipei & Guangzou. What I'm interested in figuring out is how sophisticated the attackers were. I immediately took the breached machine offline & plan on scanning it for negligees etc. I called TeamViewer & their response neither acknowledged or denied the hack. They simply asked me to report to local authorities & promised that they'd be cooperative with lots/etc.

ryanlol 10y ago

Nah, you got hit by some malware that grabbed your teamviewer credentials.

Devagamster 10y ago
If so it must have been an extremely wide spread malware because tons of people have been reporting the same thing.
- ryanlol 10y ago
  Not really, "tons" in this case isn't even hundreds.
  - gruez 10y ago
    Not everyone affected is going to post on reddit. There are plenty of tech-iliterate victims who don't even know something is wrong.
    - ryanl0l 10y ago
      I'm aware. But even tens of thousands of affected people wouldn't qualify as "an extremely wide spread malware". If you spin up an exploit pack and can't get 50k hits in a day you're clueless and should consider a career outside of cybercrime.
      - ryanlol 10y ago
        To expand on this further, most (i.e. not all) of the reddit reports are meaningless as on any given day there's going to be tens of thousands of examples of this kind of fraud. Unless the reporters have some specific evidence that teamviewer is at fault, it's overwhelmingly likely that many of them were hit by some totally unrelated fraud.
        Buge 10y ago
        Well it's related to Teamviewer for sure, because it shows up in the people's Teamviewer connection logs. Yeah it could be other malware that is stealing the Teamviewer credentials from their computer. But that seems like more work than necessary, because only a few percent of people have teamviewer installed and running, and they could attack everyone by having them malware install their own remote access service. This person formatted the drive a week ago and only had a few things installed. https://www.reddit.com/r/teamviewer/comments/4jr9qn/hacked_trough_teamviewer_1800_spent_on_paypal/ https://www.reddit.com/r/teamviewer/comments/4jr9qn/hacked_t...
      - hackney 10y ago
        It may well be a legitimate hack of TV but from a very small pool of thieves.

ocdtrekkie 10y ago

Do you have the randomly generated password disabled?

cpncrunch 10y ago

Why did you let Chrome save your paypal password? Doesn't that guarantee that anyone can empty your paypal account if they steal your computer?

ryanl0l 10y ago
Why would you care? You can call in and reverse the payment in minutes.
- cpncrunch 10y ago
  Yes, I just had a look at paypal's user agreement, and this does seem to be the case. That begs the question - why are the hackers even bothering to do this, if all their transactions will be cancelled? Are they hoping that a small % of their victims won't notice the fraudulent transactions?
  - ryanl0l 10y ago
    Most paypal fraud, like credit card fraud happens at a very small scale. A fraudster pays $50 for 50 accounts and then spends a day with them and maybe walks out with $300. The guy selling the accounts sells hundreds of thousands of them, and obviously doesn't get involved in the fraud itself. This is why this whole thing is so strange, there's a bunch of people claiming that someone hacked teamviewer and is now using that access for petty paypal fraud instead of targetting the tens (if not hundreds) of thousands of PoS systems teamviewer is used to manage. >Are they hoping that a small % of their victims won't notice the fraudulent transactions? No, they certainly don't care if the payments get charged back or not. If they try to send money to their own account, it'll be suspended before they can actually withdraw it out of PayPal. Instead in this case they seem to be trying to buy itunes gift cards, undoubtedly with the intent to sell them (on sites such as g2a.com) before they get cancelled.
    - lsaferite 10y ago
      Perhaps targeting a PoS system involves the Secret Service?

jdhawk 10y ago

I got hit as well, along with a family members computer who was logged into my account. They hit up amazon and PayPal on the other computer due to saved passwords.

wslh 10y ago

Two factor authentication is the way to go to mitigate these kind of attacks.

koolba 10y ago

Why do you have remote access set up to a computer that has unencrypted credentials stored on it?

Buge 10y ago
Because it's useful? Tons of people have ssh set up to their servers. Many of those servers might contain api keys for various services. Same thing.

Killah911 10y ago

I got hit with this too. TeamViewer showed incoming connections from Taipei & Guangzou. What I'm interested in figuring out is how sophisticated the attackers were. I immediately took the breached machine offline & plan on scanning it for negligees etc. I called TeamViewer & their response neither acknowledged or denied the hack. They simply asked me to report to local authorities & promised that they'd be cooperative with lots/etc.