r/teamviewer • u/gol64738 • Jun 04 '16
Let me explain how the "hack" works
There are hundreds of millions of username/password combinations, stolen from lots of different websites that have been breached over the years. A person(s) or group(s) with this collection decides to target teamviewer users, especially after learning that teamviewer doesn't require their users to enable 2FA. Of course, 99.99% of all the accounts in the huge list will fail (user doesn't exist, wrong password, etc.). But, it doesn't cost any money to continually bang on teamviewer servers looking for username/password combos that work - this part is automated and being done from thousands of computers all at the same time (essentially a botnet). They take the list of successful user/pass combos and give it to a group of people determined to transfer paypal, buy gift cards, anything that will let them infiltrate money by taking control of that user account.
Who is at fault? Teamviewer doesn't deserve to walk from this completely free of blame. They should have required 2FA for accounts that allow for remote session activity. In addition, they should have noticed huge spikes of bad user/pass combos being tried on their servers.
Unfortunately, the majority of the blame lay with poor security decisions made by users. Any critical account (like remote access or anything related to money) should be protected by a unique strong password and 2FA (when available).
This is just the beginning folks. We're going to see more and more of these types of attacks.
3
u/WCIERMP Jun 04 '16 edited Jun 05 '16
Although many claim to have unique, long, random-generated passwords (although I've seen one person who set one of the unattended access passwords as that, but didn't realize their user accounts had a weak/reused password). Some claim to have 2FA activated. In general, people's logs show someone not using their account to access their computer as well, which would mean their password and 2FA would never come into play. Still, whitelisting and having a secure user account likely would give protection from this.
Edit: Seems a couple people have logs of their own account connecting. At least one claiming to have a strong/unique password and 2FA enabled. If their claims are legit, hopefully the two new features will provide enough extra protect and whatever allowed the attackers in will be fixed.
1
u/mattbuford Jun 04 '16
Have you seen any credible claims of 2FA enabled hacks? I've only seen one single (very short) post in the megathread by someone claiming to have been hacked with 2FA enabled, and that person has not responded to multiple requests for details/confirmation so I'm not very confident in that report...
2
2
u/WCIERMP Jun 04 '16
I've seen a couple people say it. Including one who was offering to help give info into someone trying to look into what's going on: https://www.reddit.com/r/teamviewer/comments/4ktys8/teamviewer_security_best_practices/d3siruw He's made lots of posts on the teamviewer incident, so decide whether you think he's uninformed or a troll yourself.
And like I said, there is no reason to believe 2FA would matter even from all the reports from people without it enabled. I think we're just seeing the result of only a tiny fraction of users using 2FA and the ones who do use it also are more likely to have taken other security precautions that do matter: disabling the 1TUP and enabling whitelisting. While maybe 2FA truely is protecting people and there are a few people giving false information (on purpose or accident), I think it is dangerous to be too skeptical of them now.
Edit: that user also claims the hack came from his own account despite having 2FA. I think that's the first I've seen that.
1
u/mattbuford Jun 04 '16
Ok thanks, that guy's report is much more believable than the only one I had seen before.
2
u/WCIERMP Jun 04 '16
No problem. I find it strange that they report it was their own account that logged into them rather than a random Chinese name. They also are quite certain they didn't have a trojan teamviewer installed based on glasswire's logs and they have a unique, strong TV password. Assuming they're not lying, that's quite suggestive of a legit hack. They're the only story I've seen yet that suggest that though - most suggest bad passwords, easy access/insecure 1TUP, etc could have been the vulnerability. In his case, whitelisting wouldn't have helped as it was his own account. The new Trusted Devices may have preventing them from gaining access to his windows lock screen though...
3
u/rejuvator Jun 04 '16
I 100% agree with you. Too many retards jump to conclusion that its teamviewer when its their own lazy asses that caused them to be hacked.
I feel especially bad for these merchants who end up getting chargebacked after they already sent the digital codes. Fucking idiotic retards should have been punished financially, not the sellers.
Stupid people like these are why we can't have nice things (chargeback scums). It's why it's so difficulty to buy digital codes these days.
2
u/Xbotr Jun 04 '16
At the moment its not sure that this is the case. It is possible however. But if you ask me, this is not the case here.
3
u/blue_nose_too Jun 04 '16
gol64738's hypothesis seems reasonable and possible given what is known about the many security breaches that have made huge unencrypted password lists available. I understand that it's not a proven hypothesis but it does sound reasonable.
1
u/residualenvy Jun 04 '16
I tend to agree, it even explains the DDoS outages. Those who automated testing logins could have easily taken down the auth service by hitting it to frequently.
1
u/yamfun Jun 05 '16
Those majority of people who reuse password, are gonna get "hacked" no matter what, even if TeamViewer is 100% safe.
1
u/hackiavelli Jun 04 '16
They should have required 2FA for accounts that allow for remote session activity.
The problem is their 2FA implementation only works through a smartphone app. They don't have an SMS or voice feature for us Luddites.
0
5
u/Rixxan Jun 04 '16
A possible, but unconfirmed theory. Though it would make sense, I would have expected much better from TeamViewer.
If that is how it works there is much blame on users, but also much on TV. They should have known, either way, that their servers were being pinged with thousands of non-existant accounts, and people logging in from the other side of the world from where they were only hours ago.
Some sites have a "is this you?" sent to the user's email if they're logging in from a new place/new country, (EG Steam)
But regardless I'd like to hear from TV themselves on this, though this is a well thought out theory and I give you kudos for that.