Update
Topic: TeamViewer hacked? (Read 40,763 times)
So when I use TeamViewer to connect to one of my family's pcs, I need to either know credentials for the PC, or have to get the user to say OK before I can connect. What am I missing? Is everyone's desktop unlocked, or you have a no password required setting somewhere?There's a couple of possible explanations, but the TeamViewer folks haven't exactly been informative so far.
- carpe noctem
There's a couple of possible explanations, but the TeamViewer folks haven't exactly been informative so far.#1 would be bad, but #2 would be shameful.
The two most likely are:
1) a (really!) badly designed protocol or (more likely) programming flaws that can be exploited remotely to circumvent the password checks.
2) that TV doesn't rate-limit connection attempts, letting attackers brute-force weak passwords.
Update
[attachment 1 not found]
Update
The vast majority of the cases that we see have to do with there being a lot of data breaches lately, and whenever we're pointed to potential TeamViewer account abuses, we check internally to determine what we can see. And in virtually every case we see that the passwords and account credentials have been used elsewhere.
Another factor that plays a significant role is that people aren't using very strong passwords. They use the name of a spouse, of a kid, of a pet, or they simply do not have strong enough security measures in place like antimalware, antivirus, the type of thing that belongs on every computer these days.
We're not doubting TeamViewer accounts have been abused. It's just this is not because of a TeamViewer weakness. [...] Obviously, what we're not doubting is that yes, people have been ripped off by online criminals and their bank accounts may have been emptied, but again that's not [due to] a TeamViewer vulnerability.
Well, we are not testing any email/password combinations if you think that and we also can't see your passwords, since we use the Secure Remote Password (SRP) protocol and therefore do not store your passwords. What we do is check, if the email addresses used for TeamViewer, have been part of a leak. You can do so yourself using www.haveibeenpwned.com.
So it would be entirely plausible that a brute force attack would be able to guess passwords.
police not going to do anything.
but do push the bank, itunes, and paypal as they have the ability to reverse transactions.
I'll just add one thing for those who aren't familiar with TeamViewer -- at least when i set up mine by default TeamViewer itself created a random password for remote access (rather thank asking me to type one in) and it was SIX characters long (and i believe it's just uppercase,lowercase,and digits).
So it would be entirely plausible that a brute force attack would be able to guess passwords.
Thankfully I do not leave TeamViewer running, and have only used it on occasion when traveling. I have also set a long passphrase, so I should be ok, but I'll probably avoid using TeamViewer for a while just to be safe.
Hm... the SRP protocol ... Isn't that the one that's supposed to be Dictionary Attack resistant, and perfectly secure even when weak passwords are used because the PW is never actually exchanged with the server?Isn't the main point of SRP that you're authenticated through establishing proof of you knowing the password, without actually sending the password? There's nothing about that which prevents dictionary attacks or (other forms of) brute-forcing.
- carpe noctempolice not going to do anything.
but do push the bank, itunes, and paypal as they have the ability to reverse transactions.
...Thankfully I do not leave TeamViewer running, and have only used it on occasion when traveling. I have also set a long passphrase, so I should be ok, but I'll probably avoid using TeamViewer for a while just to be safe.
_________________________
TeamViewer has introduced some new features to make it harder to take over a user's computer from an unauthorized remote computer.
TeamViewer says that they were not hacked, and I tend to believe them. However there is currently a thriving online market in passwords stolen from various sites (LinkedIn, Adobe, etc...), so perhaps the most important step in protecting oneself from hacking is to use significantly different passwords for different sites. Long ones!
Hm... the SRP protocol ... Isn't that the one that's supposed to be Dictionary Attack resistant, and perfectly secure even when weak passwords are used because the PW is never actually exchanged with the server?Isn't the main point of SRP that you're authenticated through establishing proof of you knowing the password, without actually sending the password? There's nothing about that which prevents dictionary attacks or (other forms of) brute-forcing.
Requring a new session per login attempt isn't a bad idea, but it's more important to pad out the first couple of login attempts to several-hundred milliseconds and then do exponential backoff (with some upper limit to avoid people locking you out of your account by sending bad guesses), and perhaps some temporary IP ban after a number of failed attempts. You need to balance user friendliness (and aforementioned malicious lockout) against mitigating brute-force attacks.
PayPal accepted my appeal!
Now to close my bank account, as the bank says I will be 100% liable for any future fraud regarding that account.
I get the feeling these companies deny the initial claim just to see if the person will actually fight it.yep, absolutely common practice.
Original address: https://www.donationcoder.com/forum/index.php?topic=42694.0