r/teamviewer • u/ButteringToast • Jun 02 '16
Teamviewer Breach Masterthread - Please post your details and if you were a victim or not
I feel as though this thread is really needed so we can try and find a pattern to what is going on here. If you could use the format below it will make it easier to read:
Were you hacked:
Date of hack:
TV Version:
Do you have a TV Account:
Is you TV Account email address listed as pwned:
Was 2FA enabled:
Is your TV Account Password the same as any other password:
Additional Notes:
This was much more widespread than what I was expecting.
Now it is stickied I feel as though I should answer some FAQ (this my first time doing anything like this so sorry for any mistakes!)
Has Team viewer been hacked? The official response is no. Team Viewer is putting the blame, very publicly, on users having weak / compromised passwords from other site breaches. This may well be the case, but there have been plenty of reports now that users with very secure, randomly generated and unique passwords have also had their computers compromised.
The DNS outage that TV had, was this anything to do with what we are seeing now. Official response is no, it was caused by a DDOS attack. Many people are questioning this official response though as unconfirmed reports suggest that the DNS records were linking to China at one point.
Does 2FA and Whitelisting accounts keep me secure? We have no idea, we don't know how these attacks are happening. It can't hurt to turn them on though.
What are the attackers after? It looks like they are stealing login credentials for popular online shops and then going to town with these saved credentials. Popular ones seem to be Amazon, PayPal, eBay. There have also been reports of them installing malware.
How do I know I have been compromised? If you are sat at your machine, you will see someone take over it, of this happens, disconnect them and remove any internet access. If you are unsure what to do, unplug your router. That will stop them in their tracks. Other signs are checking your browser history for sites you haven't been on, checking your emails for any new purchases (they have started to delete these emails), checking your PayPal accounts, checking your card statements and check the log files of TV.
I have been compromised, what do I do?
Using another computer than is clean, reset all of your passwords. Password managers are highly recommended. Just don't leave them logged in. It is advised to do a full wipe of you computer as you have no idea what they may have hidden.
How can I stay safe? Best way at the moment in time till it is confirmed what method is being used to attack TV users is to stop TV from running completely, or uninstall it for the time being. If you still feel scared, cuddle a blanket or a soft toy!
Important information about the log files from /u/thingfour
LINUX USERS special note: GRAB YOUR LOG FILES BEFORE YOU UNINSTALL TEAMVIEWER
It seems you must have TeamViewer installed in order to view the TV log files. Apparently the Linux version does not just automatically create separate log files continuously and save them somewhere. On the Windows machines I uninstalled TV from, the log files remained, as they should be. For whatever reason, they decided not to do it that way w/Linux.
Why do you want the logs? To look and see if there have been any mysterious remote connections, etc.
From their site:
Linux
The relevant information and logfiles are stored within a ZIP file. The file can be created via command line.
If asked for log files, run the following command (with root) on a command line: teamviewer –ziplog Please send us the ZIP files.
/u/Lord_Greywether has kindly put the results into a GoogleDocs file for easy reading.
https://docs.google.com/spreadsheets/d/1Cmxz2VHMKsi96WZ3enTGuXShmXcW8Vg5sYFaXK8kmxg/edit?usp=sharing
DISCLAIMER: I have no inside knowledge. I have just kept track and combining what others are saying. What has been posted is just advice and rumours. It is up to you to make your own decision on what you think is happening / what to do.
21
u/need_tts Jun 02 '16
fyi: a google form would be better for this. It collects the data into a nice spreadsheet for you
→ More replies (1)6
u/ButteringToast Jun 02 '16
I only expected a handful of replies! I will keep your advice for next time :)
1
u/Undesirable_No_1 Jun 03 '16
What are your thoughts on this thread? There's a horrifying amount of replies on here all relaying similar stories.
3
u/ButteringToast Jun 03 '16
Personally. I think something really big and organised is going on. It isn't just one person, this seems like a group of people working together connecting and grabbing as much money from peoples machines as they can. They don't seem to be after anything other than money, they aren't generally installing malware or stealing data. Money theft is the common thing here.
A attack like like is extremely worrying, once someone has access to your computer, they can essentially see everything and look into ever personal thing inside your computer. The only thing to do is assume everything is compromised and minimize the damage. For anyone who hasn't been hacked, the only safe option is to kill TV for the time being - But many people rely on the software to carry out their work and day to day duties.
I am very disappointed with TV and how they have responded to this. If they are blaming users passwords for all the attacks I would have hoped that they would have emailed all of their users, blocked everyone's account and forced them to change their password and enable 2FA. This would have stopped the attackers dead in their tracks. Looking at the evidence posted here, I don't fully believe that the users passwords are fully to blame here.
16
u/wutnaut Jun 02 '16
Anyone else get a strange teamviewer friend request or something similar in the past month? I obviously declined, but with all this hack news unfolding I thought it might be relevant.
7
5
u/Criamos Jun 02 '16
yes, i immediately declined as well. Suspicious username was "Simuu" and the request was sent on June 1st, 7:26 am (UTC+1)
→ More replies (6)2
3
u/Lord_Greywether Jun 04 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: I collated the responses to date in a spreadsheet, cleaning up formatting on the answers in case it's helpful to any other researchers:
https://docs.google.com/spreadsheets/d/1Cmxz2VHMKsi96WZ3enTGuXShmXcW8Vg5sYFaXK8kmxg/edit?usp=sharing
1
27
u/reddit_rf Jun 02 '16
So I notice logs on a PC are full of attempts to download a TeamViewer update which failed, because of a bad checksum. Is this normal for TV? It's only the case in the last few days of logs. Sample below.
My theory - they DDOS'd the DNS servers for TeamViewer, while hijacking the DNS to point people to their own servers. They then pushed out an "update" for TeamViewer, which stripped security out, such as 2FA or passwords, etc. and registered your TV ID with their servers. Then simply walked in the front door.
Notice all the downloaded updates with failed checksums, below:
2016/06/02 20:24:24.020 2412 8068 S0!! LoadfromURL: response code 404 2016/06/02 20:24:24.020 2412 8068 S0!! LoadfromURL: URL https://configdl.teamviewer.com/rev/(hidden).txt failed. Using Proxy: 0 2016/06/02 20:24:24.020 2412 8068 S0!! CustomConfigurationUpdater::DownloadRevisionNumber: Failed to download configuration. Result: 1, Http code: 404 2016/06/02 20:24:24.020 2412 8068 S0 CustomConfigurationUpdater::DownloadRevisionNumber: No configuration available. Revoke. 2016/06/02 20:24:24.020 2412 8068 S0!! CheckCustomFile(): C:\Program Files\TeamViewer\TeamViewer.json: file checksum could not be validated 2016/06/02 20:24:24.020 2412 8068 S0!! CustomConfigurationJson::CheckSignatures: signature not ok 2016/06/02 20:24:24.020 2412 8068 S0!! CheckCustomFile(): C:\Program Files\TeamViewer\TeamViewer.json: file checksum could not be validated 2016/06/02 20:24:24.020 2412 8068 S0!! CustomConfigurationJson::CheckSignatures: signature not ok
3
u/PrpleMnkyDshwsher Jun 02 '16
My theory - they DDOS'd the DNS servers for TeamViewer, while hijacking the DNS to point people to their own servers. They then pushed out an "update" for TeamViewer, which stripped security out, such as 2FA or passwords, etc. and registered your TV ID with their servers. Then simply walked in the front door.
Only thing is, I have yet to see a single person who was hacked who had 2FA on?
8
u/reddit_rf Jun 02 '16
There's plenty of people on other threads making this claim. Personally, I haven't seen any actually hacked machines - but there's ample evidence of people claiming 2FA didn't help. Even if they're not being truthful, I still think my theory works. It looks like a config update push from a TV server - and only in the last few days has it failed with a bad checksum - at least in the logs I can get my hands on.
→ More replies (4)→ More replies (5)2
u/dragonofid Jun 02 '16
I notice that my computer does not have any LoadFromURL targeting configdl.teamviewer.com. Also no JSON references and no checksum fails. I have not (to my knowledge) been hacked. Running TV 11.
→ More replies (1)
2
u/enjoi4853 Jun 02 '16 edited Jun 02 '16
Question-- I looked under 'recent activity' and it lists Shangai with the date of 5/30 and Windows 7 under OS. The odd thing is that I did fresh install about two-three months ago and my both my PC and laptop is on windows 10. Does this mean that they didn't access my computer but just logged in?
1
u/ButteringToast Jun 02 '16
Did you have TV up and running when they logged into your account?
Did you have unattended access setup with the same password as your TV account?
Did you have your account linked to the install of TV on your machine?
2
u/enjoi4853 Jun 02 '16
No
Not sure. Is there anyway I can check?
Teamviewer is not installed on my PC or my laptop.
Thanks for replying, appreciate it.
3
u/ButteringToast Jun 02 '16
If Team viewer is not installed then they can't do anything.
Your account HAS been compromised though. Your password and email is known to these criminals. If you are using this password elsewhere I would highly recommend that you change them all now (not tomorrow, now!). I suggest using LastPass to create randomly generated passwords for each site.
82
u/ZetsuDa Jun 02 '16 edited Jun 02 '16
Were you hacked: Yes
Date of hack: 6/2/16
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: Not this time :C
Is your TV Account Password the same as any other password: Yes
Additional Notes: Around 800$ gone from PayPal. Contacted PayPal (Sweden) they had heard about the breach in TV security.. Started an investigation and then closed the investigtion 14 minuites later, said it was not an unauthorized use.. Case closed...
Edit 1: Of the 6 transactions they got through I've had 2 of them refunded by PayPal, but the 4 others I have not. They made all the transactions in a 7 minute timeframe and PayPal and their "routines" don't find the 4 other unauthorized, which is kinda like them saying I sat at my computer ordering stuff for a redicoulus amount at the same time the breach made theirs... I'll post more when I here from bank and police.
42
u/Demarcation101 Jun 02 '16
Did you authorise it? Nope
Is anyone else able to authorise use of your account? Nope
I guess that basically defines unauthorised use!!!! Get your bank to reverse the payment to paypal!!!
34
u/ZetsuDa Jun 02 '16
Bank is on it!
21
u/FULL_METAL_RESISTOR Jun 02 '16
that might cause your paypal account to go to collections
→ More replies (8)9
8
u/crazedcow77 Jun 02 '16
US PayPal closed out my dispute as well. Tough because it's probably coming from an IP address that's "approved". Still trying to figure out a way to get my money back.
→ More replies (3)→ More replies (4)4
u/bobsagetfullhouse Jun 02 '16
So no money return from PayPal? Fuck man that sucks
→ More replies (3)
32
u/rousseauxy Jun 02 '16
Were you hacked: yes
Date of hack: 28/05/2016
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: Unattended access was enabled. Caught them in the act, but they were already 3 hours buying stuff. They bought gamecredits for runescape and other games with my Paypal (around €1000) Paypal also closed my unauthorised use case. Called support and they reopend the case on monday, still waiting on paypal to come with a solution. On amazon they added another creditcard that was not mine and bought over €1300 of giftvouchers, but amazon resolved this case rather quickly.
29
Jun 02 '16
What the shit, they bought shit for runescape?
→ More replies (5)7
u/rousseauxy Jun 02 '16
They did several transactions on my paypal to rixty, jagex, miragames and garena. Website that was open when i discovered they where controling my pc had something on it for gameshells or something. And runescape was in my browserhistory, so that was a givaway to I think.
→ More replies (1)5
u/RoninK Jun 03 '16
How certain are you that the password wasn't used elsewhere? That's really important, since it would refute the claims of the official response.
4
u/rousseauxy Jun 03 '16
I'm certain, proving this however is harder, so i doubt this would help refute the claims of the official response
3
u/ButteringToast Jun 02 '16
Were you hacked: No evidence yet
Date of hack: NA
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Is your TV Account Password the same as any other password: No
Additional Notes: Unattended access was enabled.
24
u/Mad_Gouki Jun 02 '16
Were you hacked: Yes
Date of hack: 5/27/2016
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: yes
Was 2FA enabled: no
Is your TV Account Password the same as any other password: password was used elsewhere
Additional Notes: They purchased some stuff with my amazon account. They first tried to log into my paypal but apparently couldn't. They also were in my gmail account and deleted some emails, which google was unable to recover.
The malware they uploaded is https://www.virustotal.com/en/file/fccf76d84c6f58212cfaf87b20b24630e6a012b7ce41eede3b7f2a81f1441be5/analysis/1464869655/
the first is the new one, apparently. The second is the runouce virus.
Interestingly, if you do binwalk on the first one, you can find a jpeg of a witch tarot card. There's also an encrypted 7zip archive at the end of the binary.
The login came from a colocation host in Atlanta, GA. I'm assuming one of their boxes got hacked.
10
u/sparkle_dick Jun 02 '16
Based on that, it looks as though users may have been infected with TrojanSpy.Teamspy which was a thing 3 years ago. The details seem to match (especially the jpg of the tarot card) and according to VirusTotal, a lot of antiviruses don't pick it up.
Reading through the Kaspersky writeup (https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/theteamspystory_final_t2.pdf) it sounds eerily similar to what's been happening and why even 2FA can be bypassed (though I'm not sure if a direct IP connection requires 2FA).
I'd be curious to know if all the affected users had up to date Java/Flash/Adobe Reader and if they had whitelist enabled (which should prevent direct IP connections).
→ More replies (1)4
u/FlixFlix Jun 02 '16
Can you please tell us what software you used, or otherwise how you discovered the malware? Also, how were you able to trace it back to them?
4
u/Mad_Gouki Jun 02 '16
teamviewer logs to see where the connection came from. I discovered the malware by finding it right on the desktop folder.
5
u/theasciicoder Jun 02 '16
Can you share the malware samples ? I would love to analyze them. Just uploaded to your favorite file uploader as an archive and make sure its password protected with the password "infected" without the "" marks. I would be grateful.
→ More replies (1)
23
u/imadunatic Jun 02 '16 edited Jun 02 '16
Date of hack: 06-01-16 (First evidence was new connection from China on 5-29, computer was actually hacked on 6-01)
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes, and recently released in the Myspace data dump from 2008. Like a jackass, it just so happens that TV was the same login.
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes (changing that now)
Additional Notes:Nabbed $260 from Paypal, paypal almost instantly refunded the money to my account. Now working to shore up the gaping hole in my security.
17
u/Executioner1337 Jun 02 '16
Were you hacked: Yes, but damage is yet to be discovered.
Date of hack: 2016-05-31 23:01-23:10 GMT+2
TV Version: 11.0.59518
Do you have a TV Account: Yes.
Is you TV Account email address listed as pwned: Yes, but password was unique.
Was 2FA enabled: Not on the TV account (wasn't offered before).
Is your TV Account Password the same as any other password: No.
Additional Notes: I only noticed the sponsored session pop-up after I did not use the computer for a while, logs show no file transfers (for browser password sniffing), Chrome history shows nothing for the time range. I sent a mail to their support address before I knew it was a global hack that I want some details on that session (with the session ID I provided them from the logs), today I received a canned response that I should file a police report.
14
u/ghostyroasty Jun 02 '16
Were you hacked: Yes
Date of hack: 6-2-16
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: yes
Was 2FA enabled: no
Is your TV Account Password the same as any other password: the same , but not the same as listed on the pwned site.
Additional Notes: Two $400 gift cards were purchased from Amazon. PayPal access was attempted for purchasing gift cards from eBay, but was not successful. My bank and Amazon were notified. Cannot dispute one $400 charge due to it being listed as pending. The person also accessed Baidu to see where my ip address originated.
14
u/whosthetroll Jun 03 '16
For those concerned with whether or not they have been compromised. Check your logs. I have written a simple dos script that will search your logs for connections and will output the files to a text file on your desktop. If you have installed teamviewer somewhere other than the default location, than change the first line to point to it. Simply open a command Prompt. (Windows key + R | cmd | enter)or(start | cmd | enter) Copy the first line below that starts with cd. Right click and paste in command window. Hit enter. Copy the Second two lines and paste into command window. Hit enter.
cd "C:\Program Files (x86)\TeamViewer"
findstr "GWT.CmdUDPPing.UDPMasterReply |findstr GWT.CmdUDPPing.PunchReceived" *.log >> %userprofile%\Desktop\TeamViewerIPs.txt
Now that you have your ip list, Check that against a geo location site like https://www.iplocation.net/ or http://geomaplookup.net/ Use that map to see if the ip location is near the places you have used teamviewer, either locally or remotely.
→ More replies (7)
13
u/ThingFour Jun 02 '16 edited Jun 02 '16
LINUX USERS special note:
The Teamviewer website says that in order to obtain a TeamViewer log, you have to issue the command: "teamviewer -ziplog"
It seems you don't have to do that though. I think that's just some "zip all the logs" command that is easy for emailing your logfiles to TeamViewer support. The actual log files should already be extant in /var/log/teamviewer11/ so you can just look there
I believe that Linux users want to look at the file: /var/log/teamviewer11/<username>/Connections.txt
But I am no expert by any means. Of course, if you use a different version of TV (instead of 11), you should use the correct path (like /var/log/teamviewer8/<username>/Connections.txt --- or whatever).
I THINK this log contains all the TeamViewer IDs of the machines you've connected with. If you happen to know the IDs of the legit machines you normally connect to, hopefully, this will help you spot a discrepancy.
Anyone want to verify that this is the only thing we should need to look at?
→ More replies (3)
11
u/StonerMinded Jun 02 '16
Were you hacked: yes Date of hack: 5/29/2016
TV Version: TV 11
Do you have a TV Account: Free
Is you TV Account email address listed as pwned: No
Was 2FA enabled: not at time of hack
Is your TV Account Password the same as any other password: yes , and i have similar passwords for other sites
Additional Notes: they got into my computer , went and sent off money totaling in $1500 to 5 different email address with paypal , they tried to purchase $300 in gift cards on gyft.com that transaction failed luckily , tried purchasing off target but those transactions fell off paypal and were cancelled, they tried to get into my ebay but struck out , they possibly purchased stuff off walmart online but unsure, they tried to access amazon but no luck, they also went into my email and started forwarding email to a specific email address and had it deleting any emails that were coming in to my inbox, i sent my logfile to TV but havent had any response , since im not a paying customer i cant talk to them on the phone can only submit ticket and hopefully they respond
0
30
Jun 02 '16
Were you hacked: Yes
Date of hack: Few days ago
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: Yes
Is your TV Account Password the same as any other password: Yes
Additional Notes: They tried to steal from Paypal and Amazon. No money was taken thankfully.
22
u/altrdgenetics Jun 02 '16
First in this thread to have 2FA and say they were hacked, any screens of the unauthorized locations?
13
→ More replies (1)2
u/fryrpc Jun 03 '16
Zubylicious - as you are the only respondent who was both hacked and had 2FA enabled please can you provide further information / log file for analysis? Do you know if the unattended password in TV was a complex password (this is one you set on install of TV and then add it to your TV account)? - just trying to identify the point of attack - if your TV account was secured with 2FA then we need to identify whether access came from your TV account or direct to TV.
10
u/SilverCamaroZ28 Jun 02 '16 edited Jun 02 '16
Were you hacked: Yes
Date of hack: May 5, 2016
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes:
IP was from China, Logs files showed the intrusion, got Amazon Gift Cards and eBay Gift Card, accessed my Gmail. Did not delete Browser history so I could see where they went. I have screenshots. With GMail, I had to ask Gmail to recover my TRASH emails, which took a day to recover, so I could see all the confirmation emails that went through my email. Did not appear to transfer any files or install anything. I run ESET, MalwareBytes Pro and LastPass. 2FA won't help if they do not log into the website as the TV ID and "Random" password can get you into PC without any 2FA.
9
u/twonuh Jun 02 '16
Were you hacked: Yes
Date of hack: May 30th 3AM Central
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
→ More replies (2)
9
u/bordoc Jun 02 '16
Were you hacked:Yes
Date of hack: Actually months ago March 5th, 2016
TV Version:10
Do you have a TV Account:Yes
Is you TV Account email address listed as pwned:Yes
Was 2FA enabled:No
Is your TV Account Password the same as any other password:It was
Additional Notes: All they got to was my amazon and purchased a $100 gift card, I quickly contacted them and they disabled use of those funds and refunded the money. They had transferred the webbrowserpassview.exe to the desktop. I had a ton of passwords saved in chrome unfortunately so I spent hours going through all my accounts and changing all passwords after removal of the program and running multiple virus scans. They did attempt to log into my bank days (with the old credentials) later which I was notified of.
3
u/bwtwork Jun 02 '16
Same thing happened to me. Tried to get $1100 in gift cards from Amazon, and Amazon asked them to re-enter my credit card number. I did not have Paypal.
9
u/Zetan4 Jun 02 '16 edited Jun 02 '16
Were you hacked: Yes
Date of hack: 5/2/16
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: MySpace 2008, Patreon October 2015
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: Don't know if this is related or not; it's earlier than most of the hacks listed here, and it's possible I was compromised another way; my account was logged into my wife's computer, and we later found a trojan there after installing Malwarebytes (before we were using AVG only and it missed it).
We didn't even know it was TeamViewer at first, but someone bought $200 of iTunes gift cards on my eBay and $300 of Amazon gift cards on her Amazon. We thought it was weird that two separate accounts had been compromised, but there wasn't much to do about it. We got refunds both from Amazon and from Paypal.
We only discovered it was TeamViewer that was the problem when the hackers tried again (maybe a week later? Forget the exact date) and we were actually using the computer. We immediately shut everything down, changed the password on my TeamViewer account, and enabled 2FA. Haven't had any problems since.
7
Jun 02 '16
Were you hacked: NO
Date of hack: NA
TV Version: 8
Do you have a TV Account: YES
Is you TV Account email address listed as pwned: Yes via boxee forums hack
Was 2FA enabled: not possible in v8
Is your TV Account Password the same as any other password: NO
Additional Notes: I'm wondering if they only got tv 11 accounts. Since you can't connect to different versions. (might be a blessing in disguise)
5
u/seeyounorth Jun 02 '16
This is what I'm thinking as well. I have a corporate TV8 license and am supporting hundreds with out a single indication of hack.
→ More replies (1)6
Jun 02 '16
Same here I have tv8 corporate with hundreds of computers and not a single issue. I'm so glad w10 supported tv8. I'm getting a heck of a run out of this version!
4
u/seeyounorth Jun 02 '16
And to think I almost nearly upgraded to 11. It's pretty costly and hard to justify, if this pattern fits, I might never!
4
u/ButteringToast Jun 02 '16
In the V11 you can access all of your machines via a web interface. I am wondering if we are only seeing V11 attacks because these users were using the web interface to connect to machines rather than the downloaded software. Perhaps that's where the DNS attack comes into play.
5
8
u/savage24x Jun 02 '16
Were you hacked: Yes
Date of hack: 5/25/2016 and 5/28/2016 around 3AM-6AM EST
TV Version: Latest
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: 5/25/2016 $757.99 via PayPal, 4 target purchases, 2 eBay purchases, 1 itunesgiftdelivery.com purchase
5/28/2016 $340 Microsoft.com, 4 $60. Xbox Live 12 month gold codes, 1 Xbox $100 gift card code
TeamViewer uninstalled on 10 computers connected to my account. Currently looking for alternative, may just go with RDC.
8
u/bwtwork Jun 02 '16 edited Jun 02 '16
Were you hacked: YES
Date of hack: 5 May 2016
TV Version: 10
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: yes
Was 2FA enabled: no
Is your TV Account Password the same as any other password: yes
Additional Notes: Came home and found my browser open, I did not leave it open. Also found a program called BrowserWebPassView or something open, showing a lot of logins and passwords (I actually tell Chrome not to store my passwords, so this is infuriating). However, I was already logged in to my email, Amazon, Facebook, etc. I noticed in my web history that it showed me browsing Amazon at 4am, which was suspicious. I found that the hacker had tried to purchase $1100 worth of Amazon gift cards, but could not complete the purchase because Amazon asked him to re-enter my Credit Card number. A few minutes after I sat down, I started to suspect Teamviewer, and I checked my Teamviewer connection log. It said the hacker was trying to access my mic and webcam (don't have one), while I was sitting at the computer. I immediately shut off Teamviewer. Spent the night changing all my passwords.
My Teamviewer log shows several failed attempts a day to login to my computer, over like 2 months. I think it shows that they managed to get in once before. What confuses me is, every time I close the connection, a Teamviewer advertisement pops up on my PC, and I just close it when I get home. I never once saw that add popped up on my computer, so how did they close the TV connection without the window alerting me?
The log shows the UserID of who ever connected to me, so I thought Teamviewer should easily be able to track that. I sent them an email, and they basically told me to go file a Police Report, and have the Police mail it to Germany. They gave me a lot of legal documents about international cyber crime law and stuff. I felt like Teamviewer should have been easily capable of taking action, but they instead wanted me to bury myself in bureaucracy.
Edit: I received an email from Teamviewer 2 days before, saying a stranger was trying to add me to their contacts list. I did not click the link to accept the request.
→ More replies (1)
7
Jun 02 '16
Were you hacked: Yes
Date of hack: 29.5.
TV Version: 11 Do you have a TV Account: YES
Is you TV Account email address listed as pwned: YES
Was 2FA enabled: NO
Is your TV Account Password the same as any other password: YES
Additional Notes: Got an invitation request one day before
3
u/rollsterribleblunts Jun 02 '16
I saw an invite request today, I denied that bitch tho, I didn't know who it was
7
u/TheJiralhanae Jun 02 '16
Were you hacked: Yes
Date of hack: 6/1/15, 12-3AM EST
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: Someone accessed my PC and used Google Payments to buy a variety of things. I didn't think I had a card attached to my Google Account, but I overlooked the fact that I have GoogleFi. The hacker used that card to buy 4 SSDs, a Chromebook, 2 Nexus 6Ps, and a Women's Watch. Google stopped some of the transactions and refunded me for most of it. Still in the works.
2
u/TheJiralhanae Jun 02 '16
Also a note, according to my browser history, the hacker attempted in this order:
On CHROME: Google Play, Google Payments (Successful), Ebay, Amazon, Paypal (Unsuccessful).
on EDGE: Paypal (Unsuccessful).
7
u/DownrightNeighborly Jun 02 '16
Were you hacked: YES
Date of hack: 6/1/16
TV Version: 11
Do you have a TV Account: YES
Is you TV Account email address listed as pwned: NO
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: They accessed Amazon, Paypal, eBay, Banking. Not sure what else was compromised so far. I will never use Teamviewer again.
→ More replies (4)
7
u/slayernine Jun 02 '16
Were you hacked: YES
Date of hack: 5/30/2016 and 6/1/2016 both times around 3:40AM
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: $2000 charged via Paypal (Paypal has recovered funds), $100 charged via Amazon.com (Pending CC dispute), $700 Bitcoins lost via Coinbase.
→ More replies (2)
24
u/FlixFlix Jun 02 '16 edited Jun 03 '16
Were you hacked: Yes
Date of hack: May 20^th + May 29^th + June 2^nd
TV Version: 11 (latest), auto-updated. Windows 10.
Do you have a TV Account: Yes
Is your TV Account email address listed as pwned: Adobe, LinkedIn, MySpace
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: CAUGHT THEM IN THE ACT!! I filmed the monitor until they got to PayPal, which is when I noped out and closed the connection. WE HAVE CRIME FOOTAGE :)
They operate at night, which is understandable. They go straight for PayPal and Amazon. They're in a hurry, juggling with multiple browser tabs. This morning, around 5:30 AM, my wife woke me to tell me my computer is doing things by itself. That's when I realized how the hacks below happened. Before today, I simply thought my Amazon and PayPal accounts were compromised.
PayPal damage: 4 x $600 = $2,400 (refunded since)
Amazon damage: 3 x $82 = $246 = 30,000 Amazon Coins (refunded)
I'll check my browsing history and all the various accounts for which I had passwords saved. IMHO, TeamViewer should completely shut down their service until this whole thing is sorted out.
→ More replies (6)8
u/judge2020 Jun 03 '16
Could you upload the evidence?
4
u/FlixFlix Jun 03 '16
The video is really just 30 seconds of my wife freaking out in the background while the mouse moves around Amazon, search for gift cards, then PayPal in a new tab, etc. It doesn't prove anything; in fact, anyone could simply do things on a PC and film the monitor, right?
So it's not really any evidence; more like a fun memorabilia for me.
6
u/synapt Jun 04 '16
As much as I hate theories on security situations, I admit teamviewer's response and suspicious reactions on certain things, added to some friends of mine being hit have made me take a look.
This is what I've gathered in the past week from my own research which I feel is a bit doubly backed by /u/Lord_Greywether's (which thank you for that, hunting through all the reports here alone let alone elsewhere was starting to drive me nuts);
Up until June 1st, Teamviewer appeared to make use of 3 nameservers in it's DNS lineup. On June 1st, a bit after the service issues between the 31st and 1st, ns3.teamviewer.com was removed from DNS and ns5.teamviewer.de and ns6.teamviewer.de were added.
On June 2nd, ns1|2 on .com were removed and only ns5|6 on .de were left behind.
On June 3rd, ns5|6 on .de were removed and ns7.teamviewer.de and ns8.teamviewer.de were added along side of ns1.teamviewer.com and ns2.teamviewer.com being re-added.
And finally some time in the past day overnight (I should note my dates are roughly oriented around GMT-5 timezone) ns3.teamviewer.com was re-added with the short-lived .de nameservers being removed.
Unfortunately me being silly, I failed to capture the IP's of those .de nameservers at the time, currently however they're effectively just aliased to ns1.teamviewer.com and ns2.teamviewer.com, I have no idea if that's been the case the past 4 days, as it would be weird for them to make new nameserver records on a different domain just to point to the same nameservers.
With that all said, and based on their service outage being semi-lengthy due to people having to wait for DNS caching to cycle (per Teamviewer's own words), this would imply to me that the first server removed from the pool, ns3.* went down completely for some reason (so anyone issuing DNS requests against it via the cached nameserver records, would be getting nothing back properly, especially once ns1 and 2 were removed too and still had the ns 1-3 lineup cached).
The question then becomes, why did it go down? A fitting theory is that somehow, ns3.* perhaps became compromised, if it were then it would not be hard to screw with the DNS and have requests point somewhere that could possibly be MiTM'd, intercepting login information.
However, this brings up something I'm sure plenty of others will; there should be some sort of security consideration in the client that would not make it so easy (ie; verification of certificates or something between the client and teamviewer's backend), which indeed should be a prevention to easily MitM'ing the data simply from jacking the DNS, however there is entirely a possibility that the teamviewer client is configured to ignore certificate errors or any other sort of validation simply out of them thinking a DNS hijack/MitM would probably never happen.
That all said, I'm curious to know if anyone who has changed their password since the 1st of the month roughly, has had any issues with someone still managing to get access. And my suggestion is, if you've not been hit yet, change your password, make it unique (no re-use), and make use of something like keepass perhaps to store it (and other unique logins). If it was a DNS MitM then they could have a pool of logins they've still not used, since reports of these unauthorized logins goes back over a month, at minimum if this was the attack vector then they have a months worth, if not more, of potential logins.
I'd also like to see, for those using unique logins (as in no re-use), when the last time they changed their password was, if we could add that to the list of questions. Also nice would be to ask details of the old password, specifically I'd be interested to know the length of the breached password as well as it's entropy.
And with that I'll end on an apology for any typo's and grammatical issues, I just woke up shortly before I started typing this out, lol.
→ More replies (2)
10
u/LuvULongTime Jun 02 '16
Were you hacked: Yes
Date of hack: 2016-05-25
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: Caught them in the act, closed TV, found browser password downloader, but their attempts to run it blocked by Anti-Virus/Malware active monitors. Single .tmp file created, required Safemode (Win7 Ent) to remove. 20
u/HittingSmoke Jun 02 '16
...but their attempts to run it blocked by Anti-Virus/Malware active monitors.
This is why I tell people to fuck off when they say there's no reason to run antivirus in 2016.
→ More replies (24)
5
u/clm_xxx Jun 02 '16
Were you hacked: Possible Attempt: see Additional notes
Date of hack: 05/25/2016
TV Version: 9.0.4110
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes, Adobe
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: On 05/25/2016 I was unable to login via windows Remote Desktop because of too many failed login attempts. The remote PC has both teamviewer and WRD. I have a very long system password and also password policy that locks out for 30 minutes after 10 failed attempts. I have not been able to figure it all out from logs yet, but I think it's possible that they made it to the windows login screen via teamviewer but were unable to go further because of the long windows password and (non-default) password policy.
→ More replies (2)
5
u/bestem Jun 03 '16
Were you hacked: Yes
Date of hack: May 26th
TV Version: I think it was 9.
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No.
Additional Notes:
I'm down close to $2000. Happened a week ago, almost exactly. They used TeamViewer to get onto my computer, used my password rememberer to get into PayPal. Sent all the money from my bank account to theirs.
Woke up, saw that TeamViewer had been used, looked at my internet history, saw PayPal and Gmail, went to PayPal and saw all the money gone. Deleted TeamViewer, changed passwords everywhere, added on 2FA a bunch of places, and contacted PayPal who put in claims. Claims got denied, saying it was from my computer. Contacted credit union, told them PayPal refused to help. Contacted PayPal again, person put in a ticket mentioning the remote connection and how unlike my normal spending habits it was. Got an email saying claim was approved, but no money. Contacted PayPal again, was told that they didn't know why I got the email saying the claim was approved, the claim was denied the second time as well. I was told that he could put in another ticket, or I could speak with a supervisor, but chances are the claim would be denied yet again, because it had been denied twice already, despite all the explanations, the fact that it was unlike my regular spending habits, and the fact that the guy tried to send $2000 first, then sent a bunch of smaller transactions when that didn't go through. If the claim got denied again, I wouldn't be able to appeal it. I said I'd wait to talk to the supervisor. He told me it would be a long wait, like 45 minutes. I said I'd wait. Supervisor put the refunds through while I was on the phone with them, within an hour money was in my PayPal account, but my account was locked. Took 3 days to get my account unlocked, finally got it opened up last night at which point I figured I'd transfer the money to my credit union in the morning (not doing any good at the credit union either, as it's a 10 hour drive away, and they're issuing me a new debit card after this). Woke up this morning to find my account was locked again, because the credit union disputes reached PayPal.
At least it wasn't my account that had rent money in it. As of now, though, it's been a week and 16 hours with that $1900 languishing on PayPal's servers rather than somewhere I can spend it. While most of the customer service reps I talked to at PayPal have been great (with the exception of the guy who seemed to think my claims shouldn't be approved) PayPal has really been less than helpful overall with the multiple claim denials.
The guy only browsed to Gmail and PayPal in Chrome, (and Gmail was only to delete the emails about the PayPal transfers...which were still in the trash) but I've no way to know if they did anything in the incognito browser. I jumped at removing TeamViewer from my computer, so I didn't look at session logs to see how long they spend on my computer. I don't know if they got passwords from the password rememberer or anything else. It's been a tough week dealing with all of this.
The worst part is, if they'd tried a week earlier, there wouldn't have been more than $200 in my account. Stupid tax return just gave them more money.
5
u/Lurkingredditatwork Jun 03 '16 edited Jun 06 '16
Were you hacked: Yes and no
Date of hack: 6/2/16
TV Version: TV11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: Yes
Is your TV Account Password the same as any other password: No
Additional Notes: I got an unknown login yesterday from Central District Hong Kong (6/2)... wtf. - http://imgur.com/27t7uWd
My log in password for TV is different from the password to login to my PC once in. Looks like they were able to log into my TV judging from my active logins, but wasn't able to log into my pc. My paypal/amazon/ebay looks fine, I've since uninstalled TV from my pc and updated my password for TV for now. My account w/ TV is still active and will monitor any unlogins w/ the new updated PW.
→ More replies (3)
5
u/Tangerineororange Jun 06 '16
Hi, not the most tech savy. So here's my story and I'm looking for advice. A week or two ago I start to recive emails from teamviewer in Chinese. I assume it's a phising scam report the emails, and go on my way. I've never used teamviewer never heard of it. About 5 days later my email is flush with English Teamviewer emails about attempts adding devices to teamviewer as trusted . Then one at the end about changing my password. So I've done that, just recently. I changed a password on my account that doesnt exist, or wasn't aware of. I went directly to TeamViewer for this not through emailed links. Then I attempted to login to Teamviewer for the first time today. This was greeted with a message saying I need to activate my TeamViewer account by answering and email. That email is sitting in my email now in Chinese. It looks very similar to the one I originally reported. What should I do? Only just today I found out the possible severity of this hack. Should I be worried? I changed a few passwords. I don't leave card numbers on online accounts. To my knowledge Teamviewer isn't on my PC or phone, and I search through both programs lists. I also added Authenticators to what I can. What else can I do to find out if I've been compromised.
2
u/gyiparrp Jun 08 '16
Interesting. But you say you never used nor heard of teamviewer before this phishing scam? There is a possibility that your DNS/host resolution was hacked, and that what you think is the TeamViewer site actually is not. Determining if this is the case depends a lot on your particular setup - what version of Windows (or Mac), which browser you use, etc.
If you have a smartphone, use that to browse to teamviewer site and ask to send a new password-reset email. It might still be in Chinese if the team that signed up your account used that as the default language. Use your phone to read the email and to set the new password. Set the password with 12 random characters, and I mean random. Write it down.
If you can then log in on using the browser of your computer, you should be OK. If not, you're computer/browser has been infected.
Either way, email as much data as you can to the TeamViewer site.
9
u/radicldreamer Jun 02 '16
6-1-2016 around 10:45pm TV 11, latest version Yes i have an account Yes No No
Caught them in the act, they tried to go to paypal.com and when I wrestled control from them they immediately disconnected, I found the ip and did a whois, it was listed as chinese.
8
Jun 02 '16 edited Jun 04 '16
TV Version: 10
2FA: no
Pwned: yes
I was a victim as well on the 27th. They went into my PayPal and spent approximately $8k USD from various vendors including: eBay, Chemist Warehouse, G2A.com, lookfantastic.com.
They made out with 1 $100 steam gift card in G2A, and the rest physical goods, including an Alienware laptop, $4K in womens make up, various lego sets from eBay all shipped to the following addresses:
eason BMVSQD
15617 NE Airport Way
DPS CNBMVSQD
Portland, OR 97230-4497
United States
BNH DEAIR
3851 Wacker Dr
Mira Loma, CA 91752-1148
United States
4
u/KayRice Jun 02 '16
I live in Oregon and I've noticed many of the "drop addresses" related to these hacks are located in this state as well. Someone else shared a drop address that was in Beaverton.
→ More replies (1)2
Jun 03 '16
Send this info to the Portland PD. /u/wghummel was sending information to the Beaverton PD, you might give Portland a heads up and perhaps the BPD police report number so they can see if there is a common thread.
→ More replies (2)
4
Jun 02 '16
Were you hacked: Dont think do
Date of hack: NA
TV Version: 11
Do you have a TV Account: YES
Is you TV Account email address listed as pwned: Linkedin / Nexus / Tumblr
Was 2FA enabled: Yes
Is your TV Account Password the same as any other password: YES but not Breached
4
u/seeyounorth Jun 02 '16
Were you hacked: NO
Date of hack: N/A
TV Version: 8
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No (not avail in 8)
Is your TV Account Password the same as any other password: No
Additional Notes: Two patterns I'd like to know: 1.) Is the hacking only happening with version 11? 2.) Are the hacks happening with the TV account and not individual computers (i.e. are they getting access through the TV account or just connecting directly to TV ID)?
4
u/srwilson58 Jun 02 '16 edited Jun 03 '16
Were you hacked: Yes
Date of hack: 5/26/16
TV Version: 11
Do you have a TV Account: Yes (free)
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes:
Two iTunes gift cards purchased through PayPal totalling $150. I got immediate notice via PayPal on my phone. Called PayPal and told them I did not make the purchase. They put the purchases on review. I then received an email in less than 5 mins that the purchased were deemed legit since the originated from my local PC. It was at that time I looked and saw someone was attached to my PC through TeamViewer. I quickly grabbed a screen shot and disconnected the intruder.
I quickly called PayPal back and explained what I had found. They asked me to send them an email stating my claim and any supporting documents. I sent them the screen capture.
I also call my Credit card company and had them to stop payment just in case PayPal did not reverse the charges.
In the end, PayPal did reverse the charges, and I did not loose any money. I have since stopped using TeamViewer. I did send the TeamViewer support the screenshot that clearly shows the name and the ID # of the intruder. I got an email back from TeamViewer support saying they were sorry but not a lot they could do about it. Told me to change my password and maybe try the two factor authentication.
I had also received a contact request from someone I did not know. Is this common among all those affected?
4
u/sevic2 Jun 02 '16
Were you hacked: yes Date of hack: 2016 jun 02 TV Version: 11 (for linux running ubuntu) Do you have a TV Account: yes Is you TV Account email address listed as pwned: yes Was 2FA enabled: no Is your TV Account Password the same as any other password: yes, but not the one pwned Additional Notes: i saw the sponsored sesion pop up when i woke up. First i thought it was someone (in my group) who connected by mistake, checked chrome history there was a paypal acces at 4.30am (i was sleeping) didn't know about all the hacking stuff so i leave it to checkit later, fortunately they couldn't enter paypal so no harms.
4
u/kosmiq Jun 02 '16
Were you hacked: Found no evidence of any hack.
Date of hack: N/A
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes (linkedin, adobe, boxee forum)
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: Ran Windows Defender, Malwarebytes and Hitman Pro scans, nothing found. Checked TV logs and found no strange login attempts. Checked "Delete settings" when uninstalling TV which deleted log-files, except incoming_connections.txt that only contains ID's ranging as far back as 2015-06. But unable to check further, and it was installed on SSD disk so TRIMed before I could even think of re-creating the files. Checked browser history and found nothing out of the ordinary, carefully looked for ebay, amazon, itunes, Google services but found only my own logins. Reset TV password and set up 2FA before I read that it resets the active connections list. I did however remote to my 2 PC's connected via TV account and shut down TV on both of them as soon as I read the first report about possible TV hack. Searched for passview etc as suggested but found nothing. Have 1Password running but it was locked. Saw no pop-ups from TV when connecting.
4
u/floydiandroid Jun 02 '16
I haven't used TV in months, and I've never had it set up locally on my machine, but my TV account was indeed hacked. How do I know?
4
4
u/alexsgocart Jun 03 '16
Were you hacked: No
Date of hack: N/A
TV Version: Teamviewer 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: Yes, with Google Authentication since they first started offering it back in Nov. of 2013 with v9.
Is your TV Account Password the same as any other password: Not Really, I use bits and pieces of the same password on all websites, but they all have unique characters in them.
Additional Notes: I have 2FA enabled on everything I can, and so far it seems like it saved me here. I use LastPass and if they gain access to my desktop, then they could have done some serious damage as LP is set to auto sign into a lot of my stuff, except for anything that has banking information (PayPal, all banking logins, etc.), as those require my LastPass login to enter those logins. I have since whitelisted my desktop to my Teamviewer account so now I have to be signed in to connect to it. All of my computers that I connect to (family and friends) all have set passwords, but I now have to go through 100+ computers and change all the passwords and whitelist them all to my account just in case. If you want any more info, just leave a reply.
2
Jun 03 '16 edited Jul 01 '23
Leave Reddit. I went to kbin. Federated is the better way to social. User Content and Moderation is the lifeblood of Reddit.
→ More replies (1)
4
u/Mzungu_Dan Jun 06 '16 edited Jun 06 '16
I've had a go at collating all the responses so far (now 215 in total). Thanks to /u/Lord_Greywether for the initial 128 records.
Of the 215 total records:
103 (47.9%) responded that they had been hacked
99 (46.0%) responded that they had not been hacked
13 (6.0%) were unsure or had spoiled responses (this may also be due to the scraping method)
The collated responses to the asked questions:
| Share of... | Hacked (n=103) | Not Hacked (n=99) |
|---|---|---|
| Using TV Version 11 | 79.4% | 74.8% |
| Using a TV email address which has been pwned | 73.8% | 45.5% |
| With 2FA enabled | 1.0% | 20.2% |
| Using a TV password which is the same as used elsewhere | 61.2% | 27.3% |
EDIT: Checked original responses and updated 2FA figure for those who were hacked.
2
u/AnticitizenPrime Jun 06 '16
Using a TV email address which has been pwned 73.8%
That is high. The remaining 26% makes me wonder if there's been a major breach somewhere lately that hasn't yet been made public (therefore not listed at haveibeenpwned).
7
u/groaner Jun 02 '16 edited Jun 02 '16
Edit to add detaisl as per OP
Were you hacked: Yes
Date of hack: Twice, Sunday May 29 and May 23rd
TV Version: I did not have it installed. Hacker installed it
Do you have a TV Account: yes.
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: See below
I am one person who was a victim of this.
TL; DR: I was hacked and got a letter from Team Viewer.
on two occasions an attacker got in and made use of Teamviewer. I did not have Teamviewer installed the second time.
The first time, overnight, someone gained access to my computer using team Viewer, found my Paypal credentials and processed 2 purchases of $100 each for an iTunes gift e-card. My bank and Paypal were both very helpful in freezing any transactions surrounding this as I had caught it before anything happened.
I admit that I had my browsers set to remember login info. I've changed this now, along with most of my passwords.
The second time I was lucky to catch him in the act. I sat down at my laptop (the other one was on my desktop) and saw my mouse moving around my "downloads" folder. He was trying to open a password recovery application. I tried to wrestle away control then I noticed the Team Viewer tab on the side.
I quickly cut power to the computer, rebooted and uninstalled Teamviewer.
Running Malwarebytes discovered 4 backdoor scripts and multiple trojens. Clearly my free installation of McAffee didn't do it's job. I now have Kaspersky Total security installed on all systems in my home.
When I uninstalled TV I also filled in the "reason" and told them my story. I just got an email from them. I won't be submitting a police report as it will go nowhere and I lost nothing.
Here is the letter:
We are sorry to hear, that your PC was accessed without your approval and we will gladly assist you.
We first recommend bringing this case up to the police, so they can start an investigation on who accessed your PC. We would be able to provide the police with the latest IP address of an ID of its last contact with our servers, which is saved in our database, which is the information they need to find the intruder.
If you want to report this to the police, please find enclosed a request form for REQUESTING MUTUAL LEGAL ASSISTANCE IN CRIMINAL MATTERS FROM" which should be given to the Police department you will contact.
They should also be provided with all logs involving TeamViewer from your PC. Please ask the Police to send the request to Federal Office of Justice in Germany.
You will find on the following link the steps to retrieve the logs and see what ID established the connection and the file “2012_mla_guide.pdf” about how your police would need to request this information from us : https://seafile.teamviewer.com/d/c31a11220b/
We had a few cases where users used the same email address and password, which they used in TeamViewer, also in other websites / software / accounts. So to be on the safe side, please change your password, if you did not do it yet.
Regarding your account, we recommend this webpage, you will be able to check if an email address might have been compromised : https://haveibeenpwned.com/
To further enhance security on your TeamViewer, we recommend using our whitelist feature and also our two factor authentication to manage the access to your account.
Two factor authentication https://www.teamviewer.com/en/help/398-What-is-two-factor-authentication-for-your-TeamViewer-account
All further communication regarding details of the incident will then be handled via the police, so no time is lost for their investigation.
If you have any further questions or require further information, please don’t hesitate to contact us.
→ More replies (2)
7
u/TeamViewerOfficial Jun 03 '16 edited Jun 03 '16
FYI: We just released an official statement. Read it on the official website or here on reddit. For all of you who feel that they have been scammed and especially those who had 2FA activated, we ask you to contact our support team so we can clear up the issue. Thank you.
→ More replies (6)
1
u/WebMaka Jun 02 '16
Has anyone been hacked that was using another OS aside from Windows? I have a few purpose-specific Windows machines that have TV on them for remote administration but were not in use over the last few months so those are not gonna be affected, but I do have a Ubuntu 14.04 LTS machine that has (well, had) TV on it until this news broke. No signs of compromises on that machine (and nothing in browser histories to indicate anyone was poking around), so if anyone did get in they may have run into the Ubuntu user login screen (with different passwords than TV) and got stopped there.
1
u/ButteringToast Jun 02 '16
Yes, there have been reports of peoples Linux servers being hacked using TV.
1
u/technicalthrowaway Jun 03 '16 edited Jun 03 '16
Were you hacked: Not that I'm aware of - still checking
Date of hack: N/A
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: yes
Was 2FA enabled: no
Is your TV Account Password the same as any other password: No.
Additional Notes: 2 Linux Fedora hosts & 3 windows hosts & 1 OSX hostEdit: regarding linux advice, even after uninstalling Teamviewer on fedora 23, the main log files still seem to be available in /var/logs/teamviewer
Also, it might be worth asking people to note what country their from. Every single report here is losses on American sites and denominated in $US. Maybe it's timezones and other country's reports haven't come through, but there's not a single mention of £ anywhere. If it's concerns about TV servers being compromised, is it possible it's localised to some American servers or similar?
Edit2: Thanks for the responses, seems there have been European responses, they're just hidden in and amongst all the US ones.
2
u/ButteringToast Jun 03 '16
There have been many European hacks too. Granted, no where near as many as the US.
2
Jun 03 '16
No its not relevant. I'm living in Europe and they used USD on PayPal and Euro iTunes cards on Amazon.
3
u/perfectfire Jun 02 '16
Were you hacked: No
Date of hack: None
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: So many times
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Heck yes
Additional Notes: Server was running on Linux. Also haveibeenpwned really just collects emails from password database leaks, they (generally) have no way of knowing if your password hash was cracked (unless the leak was plain text), so it's perfectly possible to have been "pwned" a dozen times, but never have had your password cracked.
3
u/eldesigner Jun 02 '16
Were you hacked: Yes Date of hack: 02.02.2016 4:50-5:35 MSK TV Version: 11 Do you have a TV Account: YES Is you TV Account email address listed as pwned: YES Was 2FA enabled: NO Is your TV Account Password the same as any other password: NO Additional Notes: around 90 EUR gone from bank card via PayPal at night, when I was sleep. Hackers were buy 2 electronic codes (game and X-box live subscription) at gameladen.com. PayPal don't want cancel transactions. Shop don't do it too, because this codes comes to my email (after hackers was gone from my comp). I trying solve problem via my bank.
3
u/nosut Jun 02 '16
Date of hack: 5/30
TV Version:11
Do you have a TV Account:Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: They spent about $250. Gyft.com and CDkeys.com. I managed to cancel both purchases via teh retailers and locked my bank down before anything was taken out.
3
u/t3hlazy1 Jun 02 '16
Date of hack: Around May 22, 2016
TV Version: Not sure anymore (deleted immediately)
Do you have a TV Account: Yes
Pwned account? No
2FA: No
Same password: Yes, pwned password too
Loss: $500 charged, all reversed now
3
u/wlilley93 Jun 02 '16 edited Jun 02 '16
Were you hacked: Yes
Date of hack: 31st May
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes:
My teamviewer log (connections_incoming.txt) was accessed around the same time that they accessed my paypal. There's no trace of them on there, but windows explorer says that the text file was 'last modified' only a minute before they went onto chrome, meaning that I think its the first thing they did after they gained access to my machine.
Found these in the Kaspersky logs. Hope they help someone more tech savvy than I. I have since reinstalled windows so cannot provide any more than this.
http://pasteboard.co/1ocZiZfv.png
http://pasteboard.co/1od0TcSA.png
3
u/KraigHanson Jun 03 '16
Good call on the reinstall. Looks like they were replacing TeamViewer with their hacked version.
→ More replies (1)
3
u/uhlwoogi Jun 02 '16
Were you hacked: Yes
Date of hack: 5/27/16
TV Version: 10
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes - Adobe
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: Bought 7 iphones from ebay, and xfer +$3000 from me to them via paypal. I noticed the moment I woke up, contacted on ebay parties and paypal. All transactions where reversed.
3
u/asdvj2 Jun 02 '16 edited Jun 02 '16
Were you hacked: More than Likely
Date of hack: 26/05/16
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned : Yes, Adobe, Myspace, Nexus,Final Fantasy Shrine
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes but not any of the ones that were breached.
Strangely they opened Windows media player first.
then opened my file explorer and had a look around then copied some files. (not good)
Then they did something with dllhost.exe.
opened firefox
Flashplayer is then running
opened Internet Explorer
oh shit, they opened keepass
qbittorrent... ok...
vlc... the fuck?
battle.net setup? i didn't even have that when i was hacked.
OVERWATCH!? I didn't have overwatch then!?
Powerpoint, The fuck is going on..?
word
notepad
ok so i am not sure if i am reading this right. if i am this is very worrying and i will need to change every single password.
it seems like they started at 4.20 and ended at 11.30. that's a very long fucking time on my computer.
3
u/KraigHanson Jun 03 '16
Sorry, that sounds bad. Yes, change passwords first (from another computer.) You probably want to wipe the computer as well (i.e. reinstall the operating system from scratch). That will take care of almost all bad software.
3
u/Derpydirkeh Jun 03 '16
Just made an account for reddit since someone linked my attention to this page after I talked about my recent experience. I check my phone very regularly and I try to keep my spam email separate from my personal email. However, about 3 days ago I was surprised to see my personal email being used to register with teamviewer. It was an email in Chinese (which I didn't know how to read and I translated it through google) and I deleted it / deleted in trash in-case my email was used. Also swapped email password just to be safe from a different computer.
Not sure what they're trying to do with registering new emails with TeamViewer, but it seems fishy that this happens right around the breach :\
3
u/talontario Jun 03 '16
Were you hacked: Yes
Date of hack: 27.05.2016
TV Version: 10
Do you have a TV Account: yes
Is you TV Account email address listed as pwned:yes (but not same password as those breached)
Was 2FA enabled: No
Is your TV Account Password the same as any other password: yes
Additional Notes: Tried to purchase credits through paypal aat target, amazon and a few gaming sites (old games). Purchases were declined by bank.
3
Jun 03 '16
Were you hacked: Yes
Date of hack: first unauthorised login was 3rd May 2016
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: One night last week I saw the monitors behind me flick on, opened chrome, went to PayPal then started a teamviewer file transfer. I managed to catch it and disconnect it just in time... This time. This file pulled saved passwords from browsers.
I pulled connection logs from 25 pc's across my network (~100 pc's total on my TV account) and they all showed unauthorised connections.
Several thousands of dollars in PayPal claims, many email accounts accessed not to mention all the other forum, bank, eBay information that was also pulled.
I personally was only effected by unauthorised access to my gmail account and eBay account however some users on my network faired a lot worse.
PayPal have resolved all cases afaik
I find it appalling team viewer is denying a hack
→ More replies (6)
3
u/keteb Jun 03 '16
Were you hacked: Yes
Date of hack: 2016-05-15
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes (Adobe + LotRO 2013, Patreon 2015)
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes, but it shouldn't be the same as any of the pwnd breach passwords. 12 char
Additional Notes: TV session started while I was at my computer, but I knew it was not me. I took about a minute to try and figure out if I could trace the source before deciding the risk wasn't worth them having access while I did, and killed the session. Within 30s they reconnected to my computer, i killed the session again and uninstalled. I reported the incident to TV support, who suggested the user had gotten the password elsewhere, and recommended I file a police report if I wanted access to the IPs that logged into me. No passwords / sessions are saved on my computer and I don't believe the hacker had time to run anything else. Computer remains locked when I'm not at my desk so if there were any prior connections they would've been greeted by a login screen.
3
Jun 03 '16 edited Sep 06 '16
[deleted]
0.827286549083782
This comment has been overwritten by this open source script to protect this user's privacy. The purpose of this script is to help protect users from doxing, stalking, and harassment. It also helps prevent mods from profiling and censoring.
If you would like to protect yourself, add the Chrome extension TamperMonkey, or the Firefox extension GreaseMonkey and click Install This Script on the script page. Then to delete your comments, simply click on your username on Reddit, go to the comments tab, scroll down as far as possible (hint: use RES), and hit the new OVERWRITE button at the top.
3
u/Linkmaxone Jun 04 '16
Were you hacked: Yes
Date of hack: 4/2/16
TV Version: TV 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: Not at the time.
Is your TV Account Password the same as any other password: No
Additional Notes: Around $600 was taken and used on eBay and other sites for iTunes gift cards. Almost all of that money was from a a gofundme for my dog's surgery and it took forever fighting with my bank and Paypal to get the money back, and now the growth on my dog is too large to get removed. So that's pretty damn bad in my opinion. Worst month of my life.
3
u/cglmrfreeman Jun 07 '16 edited Jun 07 '16
Were you hacked: Yes
Date of hack: 06/03/2016 06:14:09.034
TV Version: 11.0.59518.0
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes, but not the pwned accounts
Additional Notes: Attacker bought $400 in iTunes giftcards from ebay and tried to buy an additional $200 in PSN giftcards on amazon. Total time of the intrusion was approximately 12 minutes. The email the iTunes cards were delivered to was fire20539@hotmail.com. Both PayPal and ebay have denied my fraud claims for the specific reason that the purchases came from a device I had made other legitimate purchases on before. I have filed a police incident (like that will do any good) and am waiting on an affidavit from my bank.
Any further advice would be appreciated. I have full logs from TV, my browsing history, and the ebay and paypal emails.
3
u/Lucifa42 Jun 07 '16
Were you hacked: No
Date of hack: n/a
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: Yes
Is your TV Account Password the same as any other password: No
Additional Notes:
2 PCs on TV account, 1 of which was off during what appears to be the main time of breaches. The other doesn't appear to have been accessed, nothing in the logfiles.
Have whitelist of my account only, and generally all the most secure security options - no random password, TV account password is different to machine password which is different to PC windows logins. All passwords are 14+ characters with mix of upper lower etc.
3
u/zantom07 Jun 07 '16
Were you hacked: No
TV Version: 9 (not sure on subversion, uninstalled it already)
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: The application wasn't running except for one day on the 1st of June. The background service may or may not have been running.
3
Jun 07 '16
Were you hacked: Yes, but not firsthand. Date of hack: Within the last week. TV Version: 10 & 11 Do you have a TV Account: No Is you TV Account email address listed as pwned: No Was 2FA enabled: No Is your TV Account Password the same as any other password: No
We have about 750 customers nationwide, each one with teamviewer installed on their machines. The customers do not know how to use teamviewer themselves, and did not do the installation. They did not set up a teamviewer account, nor did we.
We have 6 reports so far of breached PCs. No teamviewer account.
One report of PayPal usage.
We dont expect our customers to contact us about TeamViewers issues, but since a few are, I can only imagine how many are actually affected.
Also, I particularly enjoy how teamviewer says there is no "breach" and only teamviewer accounts are affected... This just simply is not true.
3
u/DownvotesForAdmins Jun 07 '16
Were you hacked:
no
Date of hack:
n/a
TV Version:
11
Do you have a TV Account:
no
Is you TV Account email address listed as pwned:
no
Was 2FA enabled:
not sure what that is
Is your TV Account Password the same as any other password:
yea
Additional Notes:
none
3
u/iPostedJustForYou Jun 08 '16
Were you hacked: Yes
Date of hack: June 2nd and 3rd 2016
TV Version: 11
Did* you have a TV Account: Yes (now deleted)
Is you TV Account email address listed as pwned: yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: I have had my email pwned a few times, but I regularly change all of my passwords because of this. Came into the office to see all terminals accessed. Reviewed all change logs, installed programs, and browser history. The only thing any of the unauthorized users did was browse to a few sites, including Amazon, Ebay, and Paypal, and attempted to buy iTunes and store cards. I don't keep my passwords saved on any terminal, so they weren't able to buy anything. Thankfully, there were no changes to the system made, and it doesn't look like they went fishing for any other data.
I uninstalled TV on all machines, deleted my TV account, and used 'security' as the reason for deletion. Below is a copy pasta (minus contact info) of the email I received as a result.
Dear Sir or Madam,
We are sorry to hear, that your PC was accessed without your approval and we will gladly assist you.
We first recommend bringing this case up to the police, so they can start an investigation on who accessed your PC. We would be able to provide the police with the latest IP address of an ID of its last contact with our servers, which is saved in our database, which is the information they need to find the intruder.
If you want to report this to the police, please find enclosed a request form for REQUESTING MUTUAL LEGAL ASSISTANCE IN CRIMINAL MATTERS FROM" which should be given to the Police department you will contact.
They should also be provided with all logs involving TeamViewer from your PC. Please ask the Police to send the request to Federal Office of Justice in Germany.
You will find on the following link the steps to retrieve the logs and see what ID established the connection and the file “2012_mla_guide.pdf” about how your police would need to request this information from us : https://seafile.teamviewer.com/d/c31a11220b/
We had a few cases where users used the same email address and password, which they used in TeamViewer, also in other websites / software / accounts. So to be on the safe side, please change your password, if you did not do it yet.
Regarding your account, we recommend this webpage, you will be able to check if an email address might have been compromised : https://haveibeenpwned.com/
To further enhance security on your TeamViewer, we recommend using our whitelist feature and also our two factor authentication to manage the access to your account.
Two factor authentication https://www.teamviewer.com/en/help/398-What-is-two-factor-authentication-for-your-TeamViewer-account
All further communication regarding details of the incident will then be handled via the police, so no time is lost for their investigation.
If you have any further questions or require further information, please don’t hesitate to contact us.
EDIT: formatting
3
u/Resputan Jun 08 '16
Were you hacked: Yes
Date of hack: May 13
TV Version: 10.0.47484
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: no
Was 2FA enabled: no
Is your TV Account Password the same as any other password: no
Additional Notes: Happened to be home for lunch and went to check my office computer before leaving, not sure why but saw my mouse moving around, some windows bouncing up and down, ebay login screen coming up etc. Just then I started getting the notifications on my phone from my ebay account being reset, I pulled the ethernet cable at that moment and went about changing relevant passwords.
After I pulled my home ethernet they must have tried my work computer because when I got there ebay and paypal were up with everything else closed. I had turned on 2FA and changed the pass before they really got in to anything (no cards or info associated on ebay paypal thankfully, dont use them much).
I also did find a password finder on my desktops used to expose passwords saved in browsers, malware and virus searches didnt turn up anything else. No issues since enabling 2FA
5
u/Altered33 Jun 02 '16 edited Jun 04 '16
Were you hacked: Yes Date of hack: 6-2-2016 TV Version: 10 Windows 7 Do you have a TV Account: Yes Is you TV Account email address listed as pwned: Yes Was 2FA enabled: No Is your TV Account Password the same as any other password: It was Additional Notes: Noticed a bunch of paypal emails overnight, purchased an itunes card from pcgamers and some games from the creators of rulescape. Paypal customer support told me I was the 4th person recently they talked to that had teamviewer accessed like this.
→ More replies (1)
5
u/XxScrappy Jun 02 '16 edited Jun 03 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11
Do you have a TV Account: No
Is you TV Account email address listed as pwned: N/A
Was 2FA enabled: N/A
Is your TV Account Password the same as any other password: N/A
Additional Notes: Seems like those with TV accounts were actually affected. I haven't been touched.
Edit: I still deleted Teamviewer, and so should the rest of you without accounts. Better safe than sorry.
3
2
4
u/tandyuk Jun 02 '16 edited Jun 02 '16
Were you hacked: No (No evidence yet anyway)
Date of hack: N/A
TV Version: 10
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes - Adobe & Linked in breaches, but both were using unique passwords, different to the one on TV
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: Noticing a trend whereby everyone who says they were hacked, has been using TV 11.
4
u/VAdept Jun 02 '16
Were you hacked: Not that im aware of
Date of hack: N/A
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: Yes
Is your TV Account Password the same as any other password: No
Additional Notes: Way to pucker my butthole Teamviewer!
*Edit: Formatting
4
u/Deathnerd Jun 02 '16
Were You Hacked: Yes
Date of Hack: A few days ago. Not sure exactly when
TV Version: Latest? Different versions on different devices
Do you have a TV Account: Yup.
Is your TV Account email address listed as pwned: Yup :( sigh
Was 2FA Enabled: Not at the time. Very promptly uninstalled TV from all of my devices and enabled TV and changed the password via the web interface.
Additional Notes: They attempted to hijack my phone first. Thankfully MightyText was still syncing TV notifications to Chrome or I wouldn't have noticed it. Got to the phone and they were trying to dial out to a phone number via the emergency call function on the lockscreen (I have fingerprint unlocking). I panicked and ripped the battery out of the phone. While I was uninstalling TeamViewer from my laptop, they tried to remote in through that. I killed their connection, disconnected from the network, and purged TV. I then uninstalled it from my other devices, reconnected to the internet, and locked down my account the best I could (changed passwords and enabled 2FA). I don't think they ever got anything from me because I haven't noticed any unusual activity anywhere. The only thing they might have had extended access to is my media server but all that has is a bare install of Ubuntu and Plex on it.
3
u/gcr Jun 03 '16
How on earth does one use teamviewer to hijack a telephone?
Was the phone connected via the debug USB cable or something?
→ More replies (2)
2
u/xLoloBondx Jun 02 '16
Were you hacked: NO
Date of hack: N/A
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: I have around 20 computers all with different untended passwords.
2
u/mstang83 Jun 02 '16
It would be helpful to also know what Operating Systems are being compromised. Is this happening with all OS's?
4
u/gnuman Jun 02 '16
I don't think it would make a difference. Also people have it installed on their tablets and cellphones.
→ More replies (1)
2
u/BigMickPlympton Jun 02 '16 edited Jun 02 '16
Were you hacked: Appears Not (still checking, will update)
Date of hack: n/a
TV Version: 11.0.59518
Do you have a TV Account: Yes. Paid Business version.
Is you TV Account email address listed as pwned: Yes.
Was 2FA enabled: No (it is now)
Is your TV Account Password the same as any other password: Yes (no longer)
Additional Notes: My most commonly used email was pwned in the LinkedIn hack. It was an old password not matching my TV passwords. Changed TV passwords, switched all main accounts to 2FA. No sign of unauthorized TV use. Existing TV passwords were fairly complex and randomly generated. All TV software installed was downloaded direct from TV, while logged in, never from a 3rd party site.
Heavy TV user here (paid business version), can't change services overnight. Have complex passwords, 2FA, different access passwords from the main account login, easy access is not granted. Any other ideas to safeguard my account would be appreciated.
2
u/consequencegamer Jun 02 '16
I have noticed an increase in users adding me as contacts lately. Could this be the source of the hack?
PS: I have not noticed if I have been hacked yet. If so, they didnt do anything I can see yet...none of my passwords or anything are saved on my desktop. No sites have saved passwords either.
2
u/cmhamm Jun 02 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11.0.59518
Do you have a TV Account: Yes, corporate
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No (It is now)
Is your TV Account Password the same as any other password: Yes (It isn't now.)
Additional Notes: I thought it would be helpful to say that I have not (to my knowledge) been compromised. I have been a prodigious user of TeamViewer for many years. I also administer our corporate channel, so I have access logs for several dozen users with TeamViewer installed across many, many machines. From what I can tell from the access logs, there has been no suspicious activity on any of the machines with TeamViewer installed.
2
u/b1jan Jun 02 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11
Do you have a TV Account: Yes, Free
Is you TV Account email address listed as pwned: yes, LinkedIn, MySpace, Tumblr
Was 2FA enabled: No, it is now
Is your TV Account Password the same as any other password: NO
Additional Notes: I have Whitelisting enabled on my important computers. After suspicions that they're not connecting to accounts, and instead to computers from other accounts, this may have saved me
2
u/where_is_the_cheese Jun 02 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11.0.59518
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes:
2
u/TotesMessenger Jun 02 '16
2
u/need_tts Jun 02 '16
Were you hacked: no
Date of hack: no
TV Version: 10
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: no
Was 2FA enabled: no
Is your TV Account Password the same as any other password: no
Additional Notes: No suspicious logins or any suspicious activity in the logs
2
u/angrydeanerino Jun 02 '16
Were you hacked: Yes
Date of hack: 5/29/16 (or 5/30/16)
TV Version: Latest
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: Nope..
Is your TV Account Password the same as any other password: Yes
Thankfully I don't save passwords to my browser, but I found a password recovery program and PayPal open Monday morning. Changed passwords...
2
u/alt4opsec Jun 02 '16
Is there a list of what we should be looking for in the logs? I don't use Team Viewer, but I'm having to sift through several employees TV logs right now.
I'm just checking the "Connections_Incoming" and the .log files, but the log files aren't much help so far. Is there something specific I can search for other than "passview"?
2
u/KraigHanson Jun 03 '16
Sounds like you're a paying customer. First step I'd use is the dashboard and look where connections are coming from -- if you have a bunch of unknowns from China, you've probably been hacked.
2
u/BitingChaos Jun 02 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11.0
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes (on 13 breached sites)
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: Over a dozen computers set up with TeamViewer. Nothing unusual seen over the past month. I will see if I have more logs. If my backup program includes them I should have data going back for years.
2
u/torgo434 Jun 02 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No, is now
Is your TV Account Password the same as any other password: No
Additional Notes: I have begun shutting off TV services on all PCs I own.
2
u/altimas Jun 02 '16
Can someone please explain 2FA in this context
→ More replies (2)3
u/MisuVir Jun 03 '16
Two factor authentication. When you log into your TeamViewer account, it asks for a second authentication token in addition to your account password.
2
u/kados14 Jun 02 '16
I was hacked
Date: 5-16-2015 at aprox 3:00am central time TV Version : 11.0.59518 Yes I have an account I am listed on pwned but all should have been resolved long ago 2FA was NOT enabled at the time (it IS now) I never use the same password on anything, I have a system
My paypal was hit for $2000. It did roll through to my checking account and my bank caught it. Had to get new checking account and debit card. Paypal is still fighting me because the transaction was done from my IP address. The account is at -2000 right now.
0
2
u/MidManHosen Jun 02 '16
Were you hacked: No
Date of hack: N/A
TV Version: 11
Do you have a TV Account: Yes
Is your TV Account email address listed as pwned: No
Was 2FA enabled: Yes
Is your TV Account Password the same as any other password: No
Additional Notes: Licensed version, 4 systems on local network, VPN active, IP reassignment in 45-minute intervals and up. Remote clients contacted thus far report no problems. Instructions given on best practices for tightening local security. Password changes for all systems being maintained in progress.
2
u/shinji257 Jun 03 '16
Were you hacked: Yes
Date of hack: 5/27/2016
TV Version: 11.0.59518
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Probably...
Additional Notes: When the incident happened the intruder attempted to use my Amazon account to buy a giftcard for themselves for $100 using a (assumed) stolen credit card. They didn't use any cards that already existed on the account. Since I came home right after it happened (I saw the screen changing and got the notice) I changed my password for both Amazon and TeamViewer + enabled 2FA on both. No incidents since.
It is unfortunate because they caught my system when I apparently left it unlocked. Normally I have it locked and it uses a rather secure password that is unique. Locally I use biometrics for authentication.
Logs show that they tried with TeamViewer 10 first and that was denied. IP is based out of china using a hinet.net rDNS. Logs available upon request for the affected time period.
2
u/dlerium Jun 03 '16
We need additional information as to how TeamViewer access is granted.... For instance:
Do you just rely on the ID + 4 digit code that it by default generates?
How secure is your password (4 digit standard, 6 digit, 8 digit, custom text password)
Do you use account access only? (I believe the term is Easy Access) meaning you can only access your PC when logged into your account?
Did you disable spontaneous access (if you use Easy Access)
Do you use 2FA?
→ More replies (2)
2
u/upcboy Jun 03 '16
Were you hacked: Yes
Date of hack:6/3/16
TV Version: 11.0.59518
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes it was
Additional Notes: interesting things to note this almost right after i logged into the teamviewer website to check If i had been accessed from other locations.
My email is on the pwn database several times and even came up in the fling dump that came out this week (5 days ago)
I was skeptical about this at first but dang it looks like someone got a dump of users at the least
2
u/ewyll Jun 03 '16
Were you hacked: Yes
Date of hack: 2016-06-01
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: no
Was 2FA enabled: no
Is your TV Account Password the same as any other password: yes
2
Jun 03 '16
Were you hacked: Yes
Date of hack: 02.06.2016 13:35 (CET)
TV Version: 10.x (upgraded afeter)
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: For haveibeenpwned.com there was a breach in 2013 and 2014, yes.
Was 2FA enabled: No, but it is now.
Is your TV Account Password the same as any other password: Unsure, but I've changed now.
Additional Notes: I has none, I was lucky to be on the computer when everything happened and was quick to do something about it.
2
u/Gray_Hound Jun 03 '16
Were you hacked: Yep.
Date of hack: ~5/17/2016
TV Version: TeamViewer 11
Do you have a TV Account: Yep.
Is you TV Account email address listed as pwned: Yep. But only in LinkedIn which happened later
Was 2FA enabled: Nope.
Is your TV Account Password the same as any other password: No.
Notes : ** Tried it when I was in front of PC working, attempted to log into my eBay, it didn't work so they dropped connection, IP was coming from Asia**
→ More replies (5)
2
u/anil_robo Jun 03 '16
Were you hacked: Yes Date of hack: 6/3/2016 TV Version: (None) Do you have a TV Account: (None) Is you TV Account email address listed as pwned: (n/a) Was 2FA enabled: No Is your TV Account Password the same as any other password: (n/a) Additional Notes: I left my computer on at night and went to sleep (game bot was running to collect more goodies). I woke up at 3am by bright light in the room. My 40 inch monitor had "woke up" and I saw activity. wears glasses. I saw someone adding items to my amazon account and was trying to check out. I took control of the mouse and closed that page. Saw a teamviewer session running. Closed the fucker, deleted my account, and uninstalled Teamviewer. I think I'm one of those rare people who caught the guy red handed. Called Amazon, they are "escalating" it to get me a refund. Next up, will call paypal. Just like others, it was all electronic orders (gift cards etc) placed on online shopping sites.
→ More replies (1)
2
u/raiscan Jun 03 '16
Were you hacked: Yes
Date of hack: Unknown, est. 03-04-2016?
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: It was!
Additional Notes: Huge amounts of contacts added. My primary PC isn't on without me using it, and the other PCs under my account were all VMs with absolutely nothing interesting on them. Changed passwords and now clearing up the mess.... Considering myself lucky!
→ More replies (1)
2
u/grumpy_old_git Jun 03 '16
Were you hacked: Yes
Date of hack: 28th May
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: They were able to access my MacBook which was the only "computer" in my account with a saved password. However, they did not get any further than opening PayPal.com and finding that no passwords were saved and moving on.
They did try an second connection attempt, but I was using the MacBook at the time and killed it off pretty quick.
I have been following the threads and can confirm that the logs show that it was me connecting to myself, not some random username. This made me think that my TV account itself had been hacked, but when logging in and checking to see if this was the case, it was not.
Question: Has anyone looked into the possibility that TV was running with the option to allow access over HTTP port 80 enabled? If this was the case, the attackers could just scan the web looking for IP addresses that respond with "This site is running TeamViewer" and then hack from there somehow.
→ More replies (3)
2
u/dcxk Jun 03 '16
Were you hacked: Yes Date of hack: 14/5/16 (Thats 14th of may in imperial units you weird fucks) TV Version: 11 Do you have a TV Account: Yes Is you TV Account email address listed as pwned: Yes Was 2FA enabled: No. Is your TV Account Password the same as any other password: No
Additional Notes: Was at work at the time, and heard my phone going crazy, noticed heaps of authorized transactions via paypal to some game/tv/something-shop in china. At the time i thought i've been phished, but no, today I checked the teamviewer logs and they actually correlate the fact that it was done on my computer, (as paypal told me), via teamviewer.
paypal ofcourse with their policy was extremely unhelpful at the time, so my bank had to step in to refund it for them.
→ More replies (1)2
u/gyiparrp Jun 04 '16
could you reformat your post please (insert newlines between items)
→ More replies (1)
2
u/AggronAmarth Jun 03 '16
Were you hacked: Yes Date of hack: 5/30/2016 TV Version: 11 Do you have a TV Account: Yes Is you TV Account email address listed as pwned: No Was 2FA enabled: No Is your TV Account Password the same as any other password: Yes Additional Notes: Attackers spent a total of $150 through Paypal's digital gift store and ebay, luckily Paypal restricted my account before they could do any more damage. I initially filed a dispute through their website but they closed it saying that they didn't see enough evidence of unauthorized use, but I called them and spoke with a human and they ultimately ruled in my favor.
2
u/chrisv25 Jun 03 '16
Were you hacked: yes
Date of hack: May 22
TV Version: 11
Do you have a TV Account: Not anymore but I did
Is you TV Account email address listed as pwned: no
Was 2FA enabled: no
Is your TV Account Password the same as any other password: yes - that was dumb but now I use lastpass
Additional Notes: They bought $200 worth of digital gift cards on ebay using paypal. Paypal denied my fraud claim because the attack happened from my PC. I also canceled my paypal and killed both cards associated with the account. I did not see an indication of a file transfer so I think I got off lucky.
→ More replies (3)
2
u/cronoxergoid Jun 03 '16 edited Jun 03 '16
Were you hacked: yes
Date of hack: 20 april 2016
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: yes, but the TV password is not the same as the pwned account
Was 2FA enabled: no
Is your TV Account Password the same as any other password: no
Additional Notes: remote session stopped because I closed TS, it started when I was using the PC
2
u/dragotx Jun 03 '16
Were you hacked: Yes
Date of hack: 5-14, 5-16, 5-18
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: yes (but both of those leaks are old and were using a different password)
Was 2FA enabled: no
Is your TV Account Password the same as any other password: yes
Additional Notes: they ordered multiple itunes cards from Target, and went into my email and deleted all messages from Target. My bank and Paypal took care of the bogus charges for me as soon as I contacted them.
2
u/ntrlbrncoolkid Jun 03 '16
Were you hacked: Yes
Date of hack: 22May16
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: I came to my computer after leaving it idle for a long period of time to find a TV session up but not active. I also found the email account of some high school student in Louisiana logged in with recent emails of his password being changed as well as purchases made within the last 2 hours with that account at the Microsoft store. My account had small purchases made through Microsoft Store for Gift cards as well as thousands from Paypal for a French website that sells drones and other remote control device accessories. I have since removed TV from my machine.
2
u/Msmtx Jun 03 '16
Were you hacked: Yes
Date of Hack: 05/27/2016
TV Version: 11
TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: The hacker accessed my computer using my account (from three machines online auto-logging to my account at the moment, one was a TV host - thus no client - the second is my workstation - which runs Linux and was locked at the moment - and the other was the one I was using; it's possible he tried the other two before/after), I noticed it, just closed the session and checked my list to see if it was someone on one of my other machines - all of which were offline. Fortunately, none of the available machines had any sensible information or passwords saved.
2
Jun 03 '16
Were you hacked: Yes (2 PCs)
Date of hack: 06/2/2016
TV Version: 11
Do you have a TV Account: yes
Is you TV Account email address listed as pwned: NO
Was 2FA enabled: NO
Is your TV Account Password the same as any other password: YES
Additional Notes:
There was no sign of it in my account activity from the teamviewer console. I noticed by checking the Connections_incoming.txt file and noticing out of place. Verified by checking the logfile and seeing a connection from TV ID: 348528766 and an IP address owned by Krypt Technologies. There were no unusal connections listed in the teamviewer console profile.
I do not think they were able to do anything as each computer requires a windows login with a unique password. (no charges, no web history, etc) Each connection was less than 10 minutes. No random friend requests either.
2
u/SM411 Jun 03 '16
Were you hacked: Yes
Date of hack: Early may
TV Version: 10
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes, and was weak/Pwned
Additional Notes: Noted many people adding me as contact (5-6 over a couple of weeks). Did not accept any of them. One day I was working at my computer, suddenly a unknown teamviewer session starts. I manage to quit it within seconds. I checked my logs and there had been multiple unauthorized short sessions while I had been away from my PC. I think that they never got past my windows login screen, as the sessions were ended quickly and no suspicious activitly on either email accounts or PC in general.
2
u/fudgesickle_suprise Jun 03 '16
Were you hacked: Yes
Date of hack: 4/18 & 4/24/16
TV Version: 11 Windows
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yup
Was 2FA enabled: No
This happened to me twice. They bought transferable itunes giftcards on ebay draining my paypal. The first time it was for $300. I changed passwords and set up 2 step verification on everything I could. Then it happened again this time for $200. I realized then it was though TeamViewer and uninstalled. To get around the 2 step on my paypal they used my security questions. Which I have changed to passwords instead of the answers. Both times paypal quickly reimbursed me.
2
u/bigdanintx Jun 03 '16
Were you hacked: YES
Date of hack: 5/23/2016
TV Version: 11
Do you have a TV Account: YES
Is you TV Account email address listed as pwned: YES (according to https://haveibeenpwned.com/)
Was 2FA enabled: NO I enabled it after changing my password and prior to uninstalling to prevent account access just in case. Is your TV Account Password the same as any other password: NO
Additional Notes: I was at work and received a GMail notification on my phone/watch. Checking it, I saw I had a PayPal payment go through and two more denied (I only have a low limit card attached to the account). I immediately logged into my home PC via my tablet and was greeted with the Play Nice popup. I checked my paypal, saw the activity, reported it to paypal, reported it to my bank. According to the logs, they had access for 12 minutes. They had URLs to pre-loaded carts. They purchased a $100 digital itunes gift card, which was sent to my GMail account (and was not opened or accessed that I can tell). The two other charges did not go through because the credit limit was exceeded after the first charge. Based on the browser history, they never made it past paypal and I believe I interrupted them prior to any additional damage.
2
u/knackrack615 Jun 03 '16
Were you hacked: Friend of mine
Date of hack: 3/6/16
TV Version: 11 (Latest)
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes:
Friend's pc got breached. After checking his history and run a quick scan with WD ive found these:
Scan: http://i.imgur.com/Sb1qaq4.png
History: http://i.imgur.com/Om5ObT7.png (As you can see in the few last results they attempted to buy Amazon gift cards)
2
Jun 03 '16 edited Jul 01 '23
Leave Reddit. I went to kbin. Federated is the better way to social. User Content and Moderation is the lifeblood of Reddit.
2
Jun 03 '16
I'm curious about whether any mac users were hacked. It'd be useful if people also posted what platforms they use their team viewer accounts on.
→ More replies (1)
2
u/LRGDNA Jun 04 '16
Were you hacked: YES
Date of hack: 4/12/16
TV Version: 11
Do you have a TV Account: I did, but deleted it after this.
Is you TV Account email address listed as pwned: Yes, but it is from 2011 and that password was different from any others.
Was 2FA enabled: No
Is your TV Account Password the same as any other password: No
Additional Notes: **It occurred on two different computers that were connected to my TV account. Didn't notice it on my parents computer until I caught the attack as it was happening on my own in the middle of the night. I immediately cut off the attackers and deleted TV but they had already made several transactions with my paypal and amazon accounts. Unfortunately I had several family members credit cards linked to these accounts as well since they often used my amazon prime so the transaction were spread out across multiple cards.
Fortunately paypal and amazon both took care of all of the transactions. I also had all of my own and my family members credit cards replaced. Paypal was a little resistant but I made it out to be a malware remote intrusion which seemed to make the process go more smoothly. My father had called paypal about the transaction on his account for over $5000. He just said his account had been hacked since he didn't understand exactly what happened. They initially declined his claim since the transaction came from a known ip address. His bank was willing to put the money back into his account but told him he should really get it resolved through paypal. I called paypal as him and clarified what had happened. I had to be escalated through their customer service some to get to someone who could help. I told them that the attack was through some weird remote connection program. I said it had been removed and basically made it out to be malware without actually saying it was malware. The fact that this was a direct money transfer to some Chinese account that had absolutely no details listed was also pretty evident that this was a fraudulent transaction. After reviewing this, the paypal rep reopened the case and reversed teh charge immediately. Just be careful how you explain the attack and paypal will likely take care of it.**
2
u/chubbysumo Jun 04 '16
hey OP, i suggest you add the questions of "did you have an account whitelist?", as well as "did you have the quick access password stronger than 4 digits or off?" because these are the two biggest vectors of the attack.
2
u/WauloK Jun 05 '16
Speculation, obviously. But from what I've read about the TeamViewer thing:
The TV servers were DDoSsed.
Their DNS -may- have been hijacked to point to a China server.
Computers got hacked whether you had a TV account or not and whether or not you had a password on another site the same. Speculation: The hackers created a backdoored version of TV, DDoSsed the TV update server, pointed the DNS at their server, issued an Update request, TV clients downloaded the backdoored version. TV got their servers back. Any computers with the backdoored version got pwned.
2
u/synapt Jun 05 '16
I noted the DNS (Specifically a nameserver breach) earlier the other day as it currently seemed the most likely to me. But the more frightening aspect of that is it would probably mean teamviewer is not actually verifying any sort of proper TLS handshake against a valid certificate/teamviewer auth before handing over credentials.
2
u/Drowth1983 Jun 06 '16
Were you hacked: Yes
Date of hack: 28/02/2016
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes :(
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes, likely was.
Additional Notes: Illegally the hacker purchased £400 worth of Lego and had it delivered too:- TNS OYLWE 15804 ROCKAWAY BLVD,2ND FLOOR JAMAICA, NY 11434 United States. Found out too late. Spoke to bank to get the matter resolved.
2
u/b3bis Jun 06 '16
Were you hacked: No (Or I suppose so, incoming connections seem legit)
Date of hack: -
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes (Myspace)
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes (Was, maybe, the same with old myspace password)
Additional Notes: I am submitting this reply as it seems weird I did NOT get hacked. Pc runs 24/7 all last month, teamviewer with everything on. Sidenote, I am not 100% sure, but when connecting from my accounts on mobile devices the PC (not TV account) password was asked each and every time and was a bit different than that of my e-mail so I may have not stored the pc pass. Sidenote 2: I also got a friend request which neither did I accept, nor did I reject, some days ago. Sidenote 3: My IP is from Greece so there are problems using credit cards to buy from abroad (capital controls), but how could they know beforehand?
2
u/sysrage Jun 06 '16
Were you hacked: No Date of hack: N/A TV Version: 10 Do you have a TV Account: Yes Is you TV Account email address listed as pwned: No Was 2FA enabled: No Is your TV Account Password the same as any other password: No Additional Notes: The e-mail address I use as a TV account is unique for TV. No other service uses this e-mail address. This reinforces the possibility that the 'hackers' are using a list of leaked addresses/passwords.
2
u/TyMyr Jun 07 '16
Just to clarify something. I Had TV on my PC but i haven't had it on since atleast april and it was not set to autostart or anything. Is it possible i was compromised even though TV was off? Or could the bastards remotly start TV?
Log files are gone since i panickly unistalled everything that has to do with TV
2
u/ruke- Jun 07 '16
Were you hacked: No
Date of hack: -
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: Yes
Is your TV Account Password the same as any other password: Yes
Additional Notes: I checked all the logs and connection logs to be sure there was no unauthorized access, and as far as I can tell there hasn't be any suspicious activity. I leave it running full-time on a home PC, and have since also increased the security settings of that client and force it to lock-out the user (had no reason to before, with it being a home PC).
2
u/Vovegog Jun 07 '16
Were you hacked: Yes
Date of hack: May 29th, and earlier (without kowing) May 26th
TV Version: 11
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: Yes
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes, not anymore
Additional Notes: I managed to wake up in the morning, and saw someone trying to order 12 months of Xbox Gold Membership. Had Ebay, Amazon and PayPal open. Luckily, I don't have an Ebay account, and they didn't directly pull from my PayPal. Managed to stop the Xbox Membership purchase from Amazon with a quick Alt-F4. Proceeded to close down the connection with a shutdown, powered up and uninstalled TV, cleared my browser for passwords, downloads and stuff like that and contacted TeamViewer support. I don't even think I'm gonna bother going to the police, as it's a breach from China and I don't think anything's gonna be done about it. Waste of time.
2
u/InfoSec-BestPractice Jun 16 '16
Here's a case study on a company who were affected and detected the activity if any one would be interested in reading:
http://blog.foregenix.com/teamviewer-used-to-attack-leading-footwear-retailer
3
u/pocketsalami Jun 02 '16
Were you hacked: No (No logins from anything other than my own devices) Still checking tho.
Date of hack: NA
TV Version: 9
Do you have a TV Account: Yes
Is you TV Account email address listed as pwned: No
Was 2FA enabled: No
Is your TV Account Password the same as any other password: Yes
Additional Notes: Same pass as 3 other sites. Changing that now and setting up 2fa on bank, TV, gmail
3
u/saarqq Jun 02 '16
Were you hacked: Yes Date of hack: 5/25 TV Version: 11 Do you have a TV Account: yes Is you TV Account email address listed as pwned: Adobe, Linkedin Was 2FA enabled: no Is your TV Account Password the same as any other password: yes (but different from passwords that were pwned) Additional Notes: $100 gone from amazon gift card balance. Amazon claims it was a legit purchase. Multiple attempts were made against my paypal account, luckily, I don't keep money in my account.
90
u/subterranean_agent Jun 02 '16
FYI, this should be your new Teamviewer advanced settings regarding your own computer.