16 ms·
GoToMyPC has been hacked, all customer passwords reset
- cm3 10y agoAren't these remote access solutions primarily on demand and therefore coupled to a one-time password generated each time it's started? Isn't Chrome's remote access otp only? Maybe it's time to ask friends/family to use that instead. I mean, if I want permanent remote access, then I'd set up a reasonably secure VPN solution that also required client side certificates, without the use of a trusted intermediary/proxy. Interactive access to remote servers seems also to get less important with push/pull of configuration/deployment recipes and immutable deployment.
- csydas 10y agoYes and no. Teamviewer, for example, has a few use-scenarios, one of which is the unattended access, which is what appeared to be compromised. Essentially there was an always-on agent process running on the target machine that you could access with a Teamviewer account you set up; said account could manage any number of PCs that had always-on unattended access. Teamviewer also has a "Quick Support" option, in which the application spawns a computer ID number and a theoretically one-time use password. The complexity of the password could be set within the application. Their QuickSupport tool, meant for a one-off support session, generates a unique session ID (in the past they had a static computer ID and a semi-unique password generated per client) which can be given to a support rep with the full version of Teamviewer to access. I have not yet followed up on the Teamviewer issue so I cannot say exactly what was compromised there, though last I remember Teamviewer was insistent their service had not been compromised, but that the unauthorized access was the result of reused passwords. GoToMyPC appears to be the former, an agent you install with the intent of unattended access on a whim. While server access is certainly one use scenario, access to non-server PCs for whatever reason is also a major part of these. Barring a breach of the software accounts or incompetently designed security for the remote access tools, it's probably okay for most people. Unfortunately, it seems like a breach is exactly what happened here with GoToMyPC, though as has been noted in the discussion already, the details are extremely sparse.
- cm3 10y agore Teamviewer: http://blog.trendmicro.com/trendlabs-security-intelligence/unsupported-teamviewer-versions-exploited-backdoors-keylogging/ http://blog.trendmicro.com/trendlabs-security-intelligence/u... It's our responsibility to not configure hard to secure and easy to exploit remote access on friend/family computers but use on demand solutions instead. If you need always-on remote access, then it's a requirement to secure it properly, and I will argue there's no need for always-on remote access on friend/family machines. Those aren't usually online anyway, so there's no hurdle to know beforehand and exchange the access token. That said, I don't understand why anyone would trust an intermediary with access to their computer. Do they have a contract in place to expect a certain level of support and security? If not, there's no explanation I can think of.
- fareesh 10y agoHow user friendly is guacamole? Anyone have any experience setting it up for non techies?
- csydas 10y agoWhile I have not set it up personally, it seems if you were to get it up and running for them and have a relatively easy to remember domain, it shouldn't be too hard. However, not having used it for a prolonged period, I don't know what the time investment for maintenance will be.
- nikolay 10y agoLame excuses ("a very sophisticated password attack") with no details so that we can estimate the risk.
- jrockway 10y agoWhat risk is there to estimate? Assume that the attackers have the clear text of your password, and know that it's your password.
- sschueller 10y agoWould be nice if they told us how they hashed it or if they hashed it at all. If the passwords are bcrypt then it wouldn't matter if an attacker got that hash.
- jrockway 10y agoStealing the password database is one vector. Modifying the login form to log the clear text of your password is another.
- frozenport 10y agoWhat you're saying is more drastic then what they wrote here. If you used the same password somewhere else, then you're going to have change all those passwords.
- jrockway 10y agoOf course you do. That's why you don't reuse passwords. Why would you trust your other accounts to their internal investigation + PR interpretation anyway?
- frozenport 10y agoBecause I'm human and can't maintain 30+ passwords?
- wsr 10y agoAs these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
- K0nserv 10y agoI use the excellent 1Password, syncing over WiFi with my phone as the source of truth for my vault. 2FA enabled for everything that supports it and backup codes stored physically. Works great and password managers are one of the few times when something is both more convenient and more secure.
- chmars 10y agoIsn't it risky to have your password and your 2FA tokens in the same app, i.e., 1Password in your case?
- eddyg 10y agoAgileBits addresses this in a blog post: https://blog.agilebits.com/2015/01/26/totp-for-1password-users/ https://blog.agilebits.com/2015/01/26/totp-for-1password-use...
- K0nserv 10y agoThat's my opinion and that's why I have my 2FA tokens in a different app. Still on the same device which might not be the best.
- anc84 10y agoI simply use keepassx with the database being synced between all my devices (Linux, Windows, Android) via Syncthing. I also have a scrambled printout in my bank safe (30€/year) that I update every couple of months.
- joemccall86 10y agoKeePassX and Syncthing over WiFi. No browser add-ons. I decided to give it a try after the LastPass acquisition to see how feasible it was, and haven't looked back really. It helps that I'm mostly on Android mobile devices. KeePass2Android is what I use on the phone.
- vt240 10y agoI wonder if this is the same group which targeted the other remote desktop service a few weeks ago?
- tim333 10y agoThe headline seems a bit inaccurate. It looks like someone is trying to hack their customer accounts rather than GoToMyPC itself.
- Hondor 10y agoIt's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.
- swiley 10y agoI run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out port 80 and 22 so I can get to it from pretty much any network.
- mikenon 10y agoYou could use https://ngrok.com https://ngrok.com to expose the ports.
- robogrowth 10y agoNgrok.com for ssh tunneling.
- smegel 10y agoOf all the things to be hacked...
- camoby 10y agoJust wait until IFTTT gets hacked. That has to be a huge target. Think of all the other services and physical devices on the network they'd potentially have the keys/access to. Future Ouch.
- robogrowth 10y agoWhy do people keep recommending these incredibly insecure passwords... replacing vowels with numbers will do little... Ugh
- 0xmohit 10y agoSuch recommendations leave little to imagination when they say: ... service has been targeted by a very sophisticated password attack
- rmdoss 10y agoThey don't really say it has been hacked, just that being a target of an advanced password attack. It might mean attackers are using password lists from previous leaks (linkedin), so they decided to force a pass reset to everyone. Or maybe they got hacked. Who knows, not very clear.
- hellomrpeter 10y agoTrue, but wouldn't this apply to any web-service in existence?
- yborg 10y agoAs has been proven many times before, "very sophisticated", "advanced", "highly complex" etc. actually generally means "our staff was humiliatingly negligent" in some regard. i.e. they were spearphished and the attacker pulled a password database from their internal network. It seems very odd that they resorted to resetting all passwords instead of just affected or potentially affected accounts as Github did recently.
- throwaway_g2p 10y agoWell since its a botnet that is trying to login with lots of different passwords and lots of different accounts its fairly obvious what the attack vector is. That's also why its safer to force a password reset than to just continue to reset passwords after they get compromised.
- magoon 10y agoThis is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.
- SNvD7vEJ 10y agoNoticed that too. If this is what their "security team" recommends, they might need to upgrade the team.
- matt_morgan 10y agoYeah, really. They also don't say another important thing, which is never use the same password in two different places. Maybe they think nobody will listen, but after seeing that other dumb advice, I don't have much faith.
- ethbro 10y agoI've never used it, but assume it's TeamViewer-esque? From the quote on their front page, assuming their target audience is of the "mycat00" at the best variety.
- hackuser 10y ago> This is not a good suggestion on their part, and has long been proven ineffective: Agreed; that is bad advice. I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g., AmeriKa), patterns on your keyboard, etc. In a more technical sense, that applies to tricks that can be defeated with an algorithm and affordable computing resources.
- shabble 10y agoAre there any good sources on what sort of generative trickery a good cracking tool will use? I've noticed that the OSX Keychain 'memorable' password suggestions are almost always /(\w+\d+[[::punc::]]+\w+)/, which is enough of a pattern to probably make an explicit generator for which will match much faster than a naive brute-force.
- graycat 10y agoGee, we have to wonder if some good anomaly detection https://news.ycombinator.com/item?id=11880593 https://news.ycombinator.com/item?id=11880593 would have detected that intrusion?
- kichuku 10y agoWhat worries me is that this product is owned by Citrix. Our company uses other products by Citrix extensively like GoToMeeting, Citrix applications etc. And if those products get compromised, then it will be a huge enterprise level financial loss.
- danellis 10y agoI used to work on the security team at Citrix. It's a very competent team that does proactive security auditing, threat modeling, pen testing and developer training as well as response. However, the "Go To" products (until a year or two ago) were part of Citrix Online, which operated independently of the rest of Citrix. So I don't see this as a reflection of the security of Citrix's core products.
- thechut 10y agoIt doesn't sound like they have been hacked directly. This looks like the same things as TeamViewer where hackers are using password lists from other breaches to attempt to compromise the high value remote desktop targets.
- riobard 10y agoIf you do it right, you don't need to reset all customers' passwords.
- wepple 10y agoThere are two things that are rapidly becoming negligent not to offer: - 2FA (mobile, yubikey, duo) - basic monitoring and notification when login patterns change These are both relatively simple and effective. You needn't force 2FA, but please offer it. A password I shared across a couple of test accounts for various services was compromised when one of the sites storing cleartext passwords was popped. A Microsoft account was the winner of the day - they notified me that a login from $home followed by a login from Brazil looked suspicious, and they were correct. This is basic and often effective.
- tmpanon1234act 10y agoThe best part about running a cybersecurity company: lots of easy, free marketing. It's a really good time to be in the industry. It is unfortunate that people are trusting companies to protect their information and it ends up being really hard to do properly. Every able-bodied security engineer really should get in the game since there's money to be made as well as good to be done.
- nojvek 10y agoIn a way I'm glad they got hacked. They'll learn the lesson by losing customers and $$$$. I'm guessing there was someone who said they should invest in security but management decided to save money.
- nojvek 10y agoI'm so glad I dropped gotomypc and went with rdp gateway. Their customer service is subpar. I tried reporting bugs and no one ever got back to me. I contact them on Twitter and email. Chirps! One day I had it enough and completely cancelled the service. There are better alternatives out there.
- solutions16 10y agoIf you have ever been a victim of any online scam, Bank account hack and you want to get your funds back as much as possible and even Gather enough evidence to prosecute as well as identify these actual identities or need to check on your partners Criminal records or Investigate a cheating spouse (consultanthackers@outlook.com) he just helps you out with whatever hack or spying activity, anything ! all you need do is get in touch . classified, certified,and highly professional . call (302) 365-0294 and Thank me later..
- bx_ 10y agoAmen