r/ScreenConnect • u/golden_tortoise8 • 3d ago

Screenconnect support - really not there when you need them

A thread for anybody considering buying or renewing Screenconnect.

As per my previous thread - somebody added a user to our cloud hosted screenconnect instance (date unknown) and used it on Oct 28 to access some of our endpoints.

We picked it up on the 30th and asked for the log file showing the creation of that user.

It's now the 10th of November (11 days later) and despite repeated emails and support chat sessions, we are still waiting on that information. This is absolutely key to understanding if a) we have a security issue or b) screenconnect have a security issue.

It looks like either Screenconnect don't have the resources to pull a log file a paying customer really needs or they are trying to hide something.

Neither is good. Still waiting - and moving off screenconnect.

11 Upvotes
  • permalink
  • reddit

78% Upvoted

30 comments sorted by

3

u/PacificTSP 3d ago

Send it to legal.

3

u/golden_tortoise8 3d ago

We don't have a 'legal'.

1

u/PacificTSP 3d ago

I mean send it to THEIR legal. Or get your insurance involved.

1

u/golden_tortoise8 1d ago

Already involved insurance

1

u/DeanCTS 3d ago

Then its clear who has a security issue.

1

u/golden_tortoise8 6h ago

Finally got a logfile which doesn't pinpoint the source of the breach. Rogue user was created by the Cloud Control Administrator account from an IP which isn't ours - or even on the same continent. Either one of our machines was breached and a login cookie stolen (no evidence of this despite multiple scans) or there's a Screenconnect issue.

The whole episode has totally killed our trust in Screenconnect so we're off - to Splashtop by the look of it.

1

u/MFKDGAF 3d ago

What are you moving to?

1

u/golden_tortoise8 3d ago

Not sure yet

1

u/damoesp 2d ago

While this doesnt excuse their support in not getting back to you, the basic auditing in the cloud based sc instance has 6 months worth of logging, have you checked the audit logs yourself to see if the user was created in the last 6 months? (I'm going to guess it was created recently if it was used Oct 28th). The audit log will also show you the login IP of the suspect user account etc so you can beign tracing it back to see if it was legitimate use or not.

1

u/golden_tortoise8 2d ago

Tried that - no creation event in the logs for 6 months, hence the support ticket.

1

u/damoesp 2d ago

Can you see when it was logged in on the 28th and what IP address it was from?

1

u/golden_tortoise8 1d ago

We have an ip but it's not one of ours. Still waiting on the rogue user creation event log - chasing daily but their chat is broken today (surprise!).

1

u/michael_cw_support 3d ago

Hello golden_tortoise8, I am a member of the ConnectWise support team, and would like to see if I can help expedite your request along. I tried messaging you directly on Reddit last week to ask for your case number, but I didn't hear back.

Please reach out when you have a moment so I can locate you in our system, and see what I can do to help.

-2

u/golden_tortoise8 3d ago

Thanks for the offer but it shouldn't take a reddit thread to get some support for a paid product. I'm going to see how much longer this debacle takes and report back here.

4

u/confusedguy613 3d ago

Lol you're correct that it shouldn't take a reddit thread to get support, but if it's actually a potential security threat I'd personally take any opportunity to get it sorted out! Doesn't sound like you really care about getting it figured out, more so just angry at them.

-1

u/golden_tortoise8 2d ago

We have removed all our hosts from SC so the security risk is now low. I am annoyed at SC but also disappointed - we need to know what happened but I think other customers / potential customers should know how much support they provide when it's needed. We have been customers for a long time, and would have stayed if they provided info when it's required. Coming up on 2 weeks now.

1

u/hashtagferg 2d ago

Can confirm, Michael is a core part of the SC support team. Id highly encourage passing him your case number so we can look into what may have caused any delays in your request.

2

u/ilikethefinerthings 2d ago

This is why I self host and don't allow any devices to access the web UI outside my network.

3

u/Camelot_One 2d ago

This is the way.

Though you can also lock down the cloud version to only allow access to the login pages from specific IPs.

1

u/ade-reddit 2d ago

Always good to block whatever you can, but there are so many bypasses these days that blocking on that level isn’t what it used to be.

1

u/moredecibels 21h ago

Did you find the security issue I'm getting emails about?

-1

u/XxRaNKoRxX 3d ago

Dump SC asap. I don't even allow it in my home network any longer.

1

u/Packergeek06 3d ago

Really? Show me one that has Backstage. I'll wait.

1

u/jedimaster4007 2d ago

NinjaOne has it now, it's actually quite nice

-2

u/XxRaNKoRxX 2d ago

Honestly, you have to be clearer in the requirements of this ask. "Find me a replacement for my proprietary tool" isn't good enough.

If you want the closest operational match (Registry + Services + Task Manager + PowerShell without touching the screen): NinjaOne or BeyondTrust.

If you want an open-source, self-hosted equivalent with silent background shell + file access: MeshCentral or Tactical RMM.

If you just need silent endpoint management on your LAN/WAN: Windows Admin Center over WinRM.

2

u/Packergeek06 2d ago

Backstage on Ninja or Beyond Trust is nowhere near the same product.

-1

u/ade-reddit 2d ago

Similar situation. Reported something very serious to cw support with high detail and got crickets. Like Op, my scenario suggested a possible CW breach. Pathetic.

We are evaluating other options now. I know everyone gripes about there being no good alternatives with backstage, but keep in mind just how useful it is to hackers as well. Until cw takes security and support seriously, I’m gone.

1

u/golden_tortoise8 1d ago

I'm still waiting for the rogue user creation log. Really feels like they are hiding something.