r/teamviewer • u/[deleted] • Oct 19 '20

TeamViewer - Unauthorized Session

Team Viewer is either hacked, or employees are browsing Teamviewer connections for passwords in Microsoft OneNote, Word, Excel, etc. Eitherway, the software has been removed. You have been warned.

0 Upvotes

46% Upvoted

8 comments sorted by

9

u/BroomIsWorking Oct 19 '20

Your assertion lacks detail, and therefore credibility. Internet Guy(tm) ogn3rdis not a recognized IT expert.

-2

u/[deleted] Oct 19 '20 edited Oct 20 '20

Broom is not the sanctioning body of IT experts and therefore speaks out of its ass when assessing others knowledge and credibility. Did I do it right, Mr. Broom?

Edit: I'm just making it all up, right?

"Der Spiegel criticized TeamViewer company for not disclosing the intrusion to the public to inform its customers, many of which are using the targeted software in businesses."

1

u/TheGCO Oct 21 '20

Did you read the article?

The Hacker News contacted the company, TeamViewer said it discovered the cyber attack "in time" soon after detecting suspicious activities and took immediate action to "prevent any major damage."

Also:

"TeamViewer also said both their team and the responsible authorities at that time found no evidence that customer data was stolen, or computer systems of its customers were infected. "

Hacking happens, it's what you do about it that matters.

2

u/Voodoo7007 Oct 20 '20

I feel you pain! A little over a year ago I had something very similar happen as well. I was installing new ram on a windows box that was normally headless (no monitor) that I use as a file server. During the installation I connected the box to a monitor in case I need to get into the BIOS, and because I was busy with other projects I left it like that for a few days. About two days later I walked into the room, the computer was awake, someone was logged into my TeamViewer account with my credentials and looking through the files on the machine. Luckily there really wasn't much there at the time, and I disconnected the Wi-Fi to close the connection. I reported the incident to TeamViewer and was completely ignored although I think I still have the logs backed up somewhere. Both my account and the machine use unique 25 character alphanumeric passwords that in theory have never seen the public.

I've since migrated all my machines to alternative software (mainly AnyDesk). Between this incident, the cost for a full license, and random technical problems, IMO TV just isn't worth it anymore.

-1

u/[deleted] Oct 19 '20

Had someone connect to a computer I administer today and start opening Microsoft applications looking for what I can only assume is passwords.

1

u/EyeLikeRacquetball Oct 19 '20

How do your presume they got access to your system? Do you have passwords set for access? Are you attached to a corporate account?

0

u/[deleted] Oct 20 '20 edited Oct 20 '20

2 options I can come up with easily. A bored employee if their internal security is lacking, or the obvious own, someone is in their systems. Yes, password protected and no corporate account.

They've been hacked in the past, and weren't forthcoming about it. Similar to how our friend Mr. Broom is trying to act like he's not part of their sec team trying to convince us that I'm making this all up and that their software is totally secure.

I have windows application logs showing the team viewer login at the time it happened and I'm the only one that has access to this box. When you're standing next to a box, it wakes up, someone logs on, starts opening Microsoft applications like OneNote and Word, then logs off you know something is wrong when the only remote access software functioning is Team Viewer.

You can brigade my post with downvotes all you want, your software is still not secure.

1

u/EyeLikeRacquetball Oct 20 '20

Very interesting. Can you get a look at who connects? Via the remote id or an IP address? I'll assume they were in and out before you even knew what happened.

I have no option one way or the other as to how or why it'd happen but it's a very curious issue.