4 ms·
Remote Desktop was exactly the mechanism here, the attacker used TeamViewer to work the UI on a plant operator’s desktop and he happened to be watching.
by closeparen 6y ago
Remote Desktop was exactly the mechanism here, the attacker used TeamViewer to work the UI on a plant operator’s desktop and he happened to be watching.
- rootsudo 6y agoSeeing reports now that it was indeed Teamviewer! They also have a satellite office over in Clearwater, Florida (which is trying to be like a little bay area copy, v2/3) Interesting, but, Teamviewer also has been exploited and leaked creds, but took three years to confirm it: https://www.bleepingcomputer.com/news/security/teamviewer-confirms-undisclosed-breach-from-2016/ https://www.bleepingcomputer.com/news/security/teamviewer-co... Or, if the client computer browsed a site, it'd actually start open an SMB share on the perps computer: https://www.bleepingcomputer.com/news/security/teamviewer-fixes-bug-that-lets-attackers-access-your-pc/ https://www.bleepingcomputer.com/news/security/teamviewer-fi... and a few other interesting vulnerabilities, hmm.
- karmicthreat 6y agoCitrix is a little more than teamviewer. And can be encapsulated in a VPN as well. Teamviewer on a desktop, probably with a shared credential isn't very secure. Knowing this though, I doubt that it was a teamviewer exploit. My guess would be a disgruntled employee since they knew what to get into to change chemical set points.
- closeparen 6y agoThey both expose Remote Desktop to the internet given the proper credentials, and I’m guessing here but I think it’s pretty likely that the attacker had credentials. Whether it was a disgruntled insider, a dumb password, or (most likely) a reused password from a leak somewhere. I would be interested to know if the TeamViewer account in question had 2FA... probably not.