4 ms·

Aren't these remote access solutions primarily on demand and therefore coupled to a one-time password generated each time it's started? Isn't Chrome's remote ac

by cm3 10y ago

Aren't these remote access solutions primarily on demand and therefore coupled to a one-time password generated each time it's started? Isn't Chrome's remote access otp only? Maybe it's time to ask friends/family to use that instead. I mean, if I want permanent remote access, then I'd set up a reasonably secure VPN solution that also required client side certificates, without the use of a trusted intermediary/proxy. Interactive access to remote servers seems also to get less important with push/pull of configuration/deployment recipes and immutable deployment.

csydas 10y ago
Yes and no. Teamviewer, for example, has a few use-scenarios, one of which is the unattended access, which is what appeared to be compromised. Essentially there was an always-on agent process running on the target machine that you could access with a Teamviewer account you set up; said account could manage any number of PCs that had always-on unattended access. Teamviewer also has a "Quick Support" option, in which the application spawns a computer ID number and a theoretically one-time use password. The complexity of the password could be set within the application. Their QuickSupport tool, meant for a one-off support session, generates a unique session ID (in the past they had a static computer ID and a semi-unique password generated per client) which can be given to a support rep with the full version of Teamviewer to access. I have not yet followed up on the Teamviewer issue so I cannot say exactly what was compromised there, though last I remember Teamviewer was insistent their service had not been compromised, but that the unauthorized access was the result of reused passwords. GoToMyPC appears to be the former, an agent you install with the intent of unattended access on a whim. While server access is certainly one use scenario, access to non-server PCs for whatever reason is also a major part of these. Barring a breach of the software accounts or incompetently designed security for the remote access tools, it's probably okay for most people. Unfortunately, it seems like a breach is exactly what happened here with GoToMyPC, though as has been noted in the discussion already, the details are extremely sparse.
- cm3 10y ago
  re Teamviewer: http://blog.trendmicro.com/trendlabs-security-intelligence/unsupported-teamviewer-versions-exploited-backdoors-keylogging/ http://blog.trendmicro.com/trendlabs-security-intelligence/u... It's our responsibility to not configure hard to secure and easy to exploit remote access on friend/family computers but use on demand solutions instead. If you need always-on remote access, then it's a requirement to secure it properly, and I will argue there's no need for always-on remote access on friend/family machines. Those aren't usually online anyway, so there's no hurdle to know beforehand and exchange the access token. That said, I don't understand why anyone would trust an intermediary with access to their computer. Do they have a contract in place to expect a certain level of support and security? If not, there's no explanation I can think of.

by cm3 10y ago

csydas 10y ago

Yes and no. Teamviewer, for example, has a few use-scenarios, one of which is the unattended access, which is what appeared to be compromised. Essentially there was an always-on agent process running on the target machine that you could access with a Teamviewer account you set up; said account could manage any number of PCs that had always-on unattended access. Teamviewer also has a "Quick Support" option, in which the application spawns a computer ID number and a theoretically one-time use password. The complexity of the password could be set within the application. Their QuickSupport tool, meant for a one-off support session, generates a unique session ID (in the past they had a static computer ID and a semi-unique password generated per client) which can be given to a support rep with the full version of Teamviewer to access. I have not yet followed up on the Teamviewer issue so I cannot say exactly what was compromised there, though last I remember Teamviewer was insistent their service had not been compromised, but that the unauthorized access was the result of reused passwords. GoToMyPC appears to be the former, an agent you install with the intent of unattended access on a whim. While server access is certainly one use scenario, access to non-server PCs for whatever reason is also a major part of these. Barring a breach of the software accounts or incompetently designed security for the remote access tools, it's probably okay for most people. Unfortunately, it seems like a breach is exactly what happened here with GoToMyPC, though as has been noted in the discussion already, the details are extremely sparse.

cm3 10y ago
re Teamviewer: http://blog.trendmicro.com/trendlabs-security-intelligence/unsupported-teamviewer-versions-exploited-backdoors-keylogging/ http://blog.trendmicro.com/trendlabs-security-intelligence/u... It's our responsibility to not configure hard to secure and easy to exploit remote access on friend/family computers but use on demand solutions instead. If you need always-on remote access, then it's a requirement to secure it properly, and I will argue there's no need for always-on remote access on friend/family machines. Those aren't usually online anyway, so there's no hurdle to know beforehand and exchange the access token. That said, I don't understand why anyone would trust an intermediary with access to their computer. Do they have a contract in place to expect a certain level of support and security? If not, there's no explanation I can think of.