6 ms·
TeamViewer Security Breach
- portaouflop 2y agoUsing TeamViewer is a security breach.
- dylan604 2y agoI didn't think anyone used TeamViewer anymore except as ManU jersey sponsor which says all you need to know.
- starttoaster 2y agoNot sure about your opinion about TeamViewer in particular, but if you manage any MacOS servers there's not much alternative but to have some form of remote desktop client in my experience. If you're on a team where everyone has Macbooks, you probably just use the builtin screen sharing app though. For Windows environments you're probably using Remote Desktop, which, enough said there.
- kspacewalk2 2y agoYou can use Remote Desktop on MacOS.
- 1over137 2y agoonly from a Mac, not to a Mac.
- Terretta 2y agoNot sure that's right. In general any Mac can serve its desktop to the Apple Remote Desktop client: https://support.apple.com/guide/mac-help/allow-apple-remote-desktop-to-access-your-mac-mh11851/mac https://support.apple.com/guide/mac-help/allow-apple-remote-... Also can support most any VNC viewer. But FileVault has to have been unlocked.
- bitwize 2y agoDoesn't macOS have a built-in VNC server?
- edm0nd 2y agoWhat are yall using macOS Server for? I thought it was end of life'd.
- yjftsjthsd-h 2y agoI think we're talking about normal macs that are being used as servers, not Xserve
- infogulch 2y agoTried RustDesk?
- _mlbt 2y agoJump desktop works really well for connecting remotely to macOS... https://jumpdesktop.com https://jumpdesktop.com
- bakugo 2y agoWhat do you use instead?
- arsome 2y agoRustDesk has been pretty good for something that's 1:1 comparable, but for most cases ssh or rdp is preferable.
- DANmode 2y agoAnyDesk is by former TeamViewer folks.
- zfa 2y agoSelf-hosted Mesh Central.
- KentGeek 2y agoI dumped TeamViewer a few months ago in favor of Google Remote Desktop. It satisfies my occasional low bar requirements, and doesn't make me feel guilty for using it without pay. I connect between iPad, Windows, Linux, a couple of times a month. Easiest thing I've found so far.
- dylan604 2y ago"There is no evidence to suggest that the product environment or customer data is affected." Yet.
- noinsight 2y agoI've heard C-suite literally say: "if there's no logging, there can be no evidence"...
- wepple 2y agoWith recent govt mandates to report known incidents within XX hours, this approach will possibly become the gold strategy
- mulmen 2y agoA win for privacy?
- wepple 2y agoOh no no no. They’ll still collect data about people. Just not security logs that could indicate an incident. Double loss for privacy.
- Vegenoid 2y agoData will still be harvested. Logs that indicate when or how it was harvested, where it has been sent, or who has accessed it - those are the things that will be killed.
- imglorp 2y agoKeeping no evidence of misbehavior is already becoming standard practice to avoid regulators. https://www.bloomberg.com/news/articles/2024-01-26/doj-ftc-warn-companies-to-preserve-signal-and-slack-chats https://www.bloomberg.com/news/articles/2024-01-26/doj-ftc-w... or https://archive.is/T5f3G https://archive.is/T5f3G
- imglorp 2y agoAt least they have a nice disclosure page and acknowledge researchers. https://www.teamviewer.com/en/resources/trust-center/security-bulletins/ https://www.teamviewer.com/en/resources/trust-center/securit...
- miles 2y agoMore background: TeamViewer's corporate network was breached in alleged APT hack https://www.bleepingcomputer.com/news/security/teamviewers-corporate-network-was-breached-in-alleged-apt-hack/ https://www.bleepingcomputer.com/news/security/teamviewers-c...
- ryanmccullagh 2y agoI would imagine this is due to a Product manager vetoing time spent on Security Considerations.
- keraf 2y agoThe revenue tunnel vision disease that PMs have, totally ignoring features and other important things that have not a direct impact on that number. Hopefully we'll get a vaccine soon! On a more serious note, security breaches can happen to anyone. Might not be fair to assume it's the PMs negligence. In fact, I met some that really saw the value in security and cared to dedicate the resources on it even if that meant not shipping more features.
- dangoodmanUT 2y agoOn the this episode of a teamviewer security breach...
- ssamjh 2y agoSo glad we're no longer using TV at work.
- ale42 2y agoLol, I first thought "what's the link between televisions and TeamViewer?"
- diebeforei485 2y agoSo many scammers use TeamViewer that I'm surprised they are still in the App Store
- isodev 2y agoIt has in-app purchases! Apple doesn't reject shady apps that bring revenue unless it's really bad for PR.
- hgrwant 2y agoAgain? The last ransomware issue was like in the beginning of this year: https://www.techradar.com/pro/security/hackers-target-teamviewer-to-try-and-get-access-to-your-companys-network https://www.techradar.com/pro/security/hackers-target-teamvi... Not surprising, if Teamviewer lets other people control your machine by design.
- 2Gkashmiri 2y agoRustdesk. Been using it locally over a zerotier network for over 2 years now. Bulletproof. It works. There was a scare about accepting certificates from. "Chinese Devs" but they removed that I think. It is being built like a war machine, copying features left and right. It does have keyboard issues, persisting but still good
- rustdesk 2y agoAn open-source, self-hosted remote desktop solution can be more secure.
- Rinzler89 2y agoWill you start writing one?
- josephcsible 2y agoLook at the profile of the person you replied to.
- GaryNumanVevo 2y agoWell what a coincidence, the person you're replying to has done precisely that! https://github.com/rustdesk/rustdesk https://github.com/rustdesk/rustdesk
- miles 2y agoRustDesk Installs Chinese Root Certificates (4 months ago, 68 points, 19 comments) https://news.ycombinator.com/item?id=39256493 https://news.ycombinator.com/item?id=39256493
- GaryNumanVevo 2y agoI don't think this is the "gotcha" you think it is. 1. The developer isn't Chinese, he's Singaporean. The "Chinese" found in the cert path was literally gibberish, most likely garbled unicode. 2. They were using a dev cert for a virtual video driver, which they're working on getting proper signing from MSFT and also have a workaround virtual driver in the mean time. https://x.com/rustdesk/status/1781263566504653052 https://x.com/rustdesk/status/1781263566504653052
- miles 2y ago> I don't think this is the "gotcha" you think it is. Sorry it came across as a "gotcha"; just meant as a potentially-relevant HN post from a few months ago in the spirit of sharing and curiosity. But digging a bit further, I did find a few HN comments from two years ago that may be worth considering; pizza234's "I personally discourage people from using this software."[1] and proto_lambda's "If this is the kind of thing that's considered acceptable by the developer, I'd rather keep their products far away from my machines."[2] [1] https://news.ycombinator.com/item?id=31457238 https://news.ycombinator.com/item?id=31457238 [2] https://news.ycombinator.com/item?id=31456522 https://news.ycombinator.com/item?id=31456522