5 ms·
Remote access giant AnyDesk resets passwords and revokes certificates after hack
- calgarymicro 3y ago> AnyDesk spokesperson Matthew Caldwell did not respond to an email from TechCrunch. CrowdStrike, which is working with AnyDesk to remediate the cyberattack, declined to answer TechCrunch’s questions when reached Monday. > AnyDesk did not respond to questions asking if any customer data was accessed, though the company said in its statement that there is “no evidence that any end-user systems have been affected.” > “We can confirm that the situation is under control and it is safe to use AnyDesk,” AnyDesk said. “Please ensure that you are using the latest version, with the new code signing certificate”. Mmm. If I were an AnyDesk customer I'd definitively want more details on what actually happened before I used their software again.
- ziddoap 3y ago>AnyDesk did not respond to questions asking if any customer data was accessed, though the company said in its statement that there is “no evidence that any end-user systems have been affected.” In my experience, this answer is equivalent to "Yes, customer data was accessed". If it wasn't, they'd say something like "We have no reason to believe customer data was accessed", instead of trying to shift the focus to whether or not end-user systems were caught up in the blast radius.
- user3939382 3y agoSad that what we white wash with the label "PR" or sometimes a hair worse "spin" is actually misrepresentation and dishonesty which is so pervasive (and therefore actually horrible) in corporate culture that it is totally normalized. I don't care if every country in the world does it, it is not okay to deceive, twist, and spin things.
- amelius 3y agoIt's the total imbalance of power.
- mattigames 3y ago"mislead the focus" should be a valid and common way to describe this kind of thing.
- matbilodeau 3y agothere are accounts for sale https://securityonline.info/anydesk-breach-2024-dark-web-sale-of-18317-credentials/?expand_article=1 https://securityonline.info/anydesk-breach-2024-dark-web-sal...
- ThePowerOfFuet 3y agoIf (huge if!) those screen shots are legit, then Anydesk was storing passwords in cleartext or equivalent; many of them are far too random to be bruteforced so quickly. The last one, where both the domain name and password start with QR, makes me think the screenshots might actually be legit.
- matbilodeau 3y agoSeen on Breach Forums onion site as well ...
- GoblinSlayer 3y ago>In light of this breach, AnyDesk customers must take proactive steps to protect their accounts and data. Password changes alone are insufficient. Go figure :)
- fieldcny 3y agoThe vagueness of end-user is also a little concerning, are they using it in sense a lot of corporate it folks do to mean employees, or are they implying their customers are their end users.
- tecleandor 3y agoI understand Crowdstrike not talking about their client (as much as I hate their agent). But that "new code signing certificate" smells very bad. I would nuke anything signed by them ASAP.
- pintxo 3y ago> I'd definitively want more details on what actually happened before I used their software again. You’re probably not in their target demographic to begin with, if you ask such questions.
- kuon 3y agoDo you know any cross platform (Linux,windows) similar tool that is as easy and traverse firewall well? I can host a server if needed. I often use vnc myself but for end user it is way too hard to install.
- CamperBob2 3y agoTeamViewer is slow and expensive, but it does work well. IIRC they have Linux support now, but not 100% sure.
- tczMUFlmoNk 3y agoI was using TeamViewer on Linux fairly extensively over a decade ago, and I don't really recall having issues with it. I haven't used it much recently.
- jeroenhd 3y agoRustDesk is often mentioned as an open source alternative. It has a bunch of weird code smells that make me a bit hesitant to use it for supporting family members, but it seems to work well from what I read from others? I use Teamviewer quite regularly, but that has some issues with Wayland. Free for personal use, but closed source with no self-hosting capabilities.
- timbit42 3y agoI've used TeamViewer, then AnyDesk and now RustDesk. TeamViewer and AnyDesk are both German companies. RustDesk works really well and is fast. I switched from TeamViewer because they wanted money. I switched from AnyDesk because it gave me more problems with disconnecting, has the worst UI of the three and sometimes my screen would be a minute or more behind what the host was seeing.
- bloqs 3y agohttps://news.ycombinator.com/item?id=39256493 https://news.ycombinator.com/item?id=39256493 please exercise caution
- marcodiego 3y agoSuppose I have a computer at home I want to be able to access from anywhere in the world. I can pay a host, a vpn, something like aws or resort to proprietary solutions like teamviwer or similar options. I don't want to resort to any of these alternatives. I want something that is both open source and that I don't have to pay for. The only solution I could find was tor (or maybe i2p) which has its own downsides: high latency, low bandwidth and requires special tools. Is there any possibility I'm not considering?
- efdee 3y agoI've turned to RustDesk since last week, and so far so good. It's open source and if you self-host the rendezvous server, it's effectively free.
- vel0city 3y agoAny reason why you can't run a VPN server in your home environment? I run wireguard and OpenVPN at home on my router. I don't pay for static IPs but they rarely ever actually change.
- chx 3y agodynamic dns to the rescue
- Helmut10001 3y agoGet yourself a box with OPNsense and run wireguard on it. It requires some working in, but it is a big liberation after a while.
- _xerces_ 3y agoI thought that was just a tool used by India-based scammers to access old people's computers.
- taskforcegemini 3y agoand I was just about to recommend AnyDesk to my employer after having had several bad experiences with TeamViewer in the past