It was a tough week for TeamViewer, a service that allows computer professionals and consumers to log into their computers from remote locations. For a little more than a month, a growing number of users have reported their accounts were accessed by criminals who used their highly privileged position to drain PayPal and bank accounts. Critics have speculated TeamViewer itself has fell victim to a breach that’s making the mass hacks possible.
On Sunday, TeamViewer spokesman Axel Schmidt acknowledged to Ars that the number of takeovers was “significant,” but he continued to maintain that the compromises are the result of user passwords that were compromised through a cluster of recently exposed megabreaches involving more than 642 million passwords belonging to users of LinkedIn, MySpace, and other services.
Ars spoke with Schmidt to get the latest. What follows is a lightly edited transcript of the conversation:
Ars: As we’re having this conversation on Sunday morning, is it still TeamViewer’s belief that the account takeovers are the result of password reuse and passwords exposed in breaches external to TeamViewer?
TeamViewer: Yes, exactly. That’s what we believe. The vast majority of the cases that we see have to do with there being a lot of data breaches lately, and whenever we’re pointed to potential TeamViewer account abuses, we check internally to determine what we can see. And in virtually every case we see that the passwords and account credentials have been used elsewhere.
Another factor that plays a significant role is that people aren’t using very strong passwords. They use the name of a spouse, of a kid, of a pet, or they simply do not have strong enough security measures in place like antimalware, antivirus, the type of thing that belongs on every computer these days. Another thing we would recommend apart from selecting very strong and unique passwords is the use of password managers. Because that way all you have to do is remember one password and store all your other passwords safely.
A: What is the status of your investigation into reports that somehow some of these attackers have been able to bypass two-factor authentication?
T: As of now we really have no conclusive evidence that our two-factor authentication has been compromised in any way. As you may know, there are a lot of discussions going on, on Reddit, for instance, and we’re reaching out to folks who claim their devices have been compromised even though they have the 2fa enabled. Up to this point, we really have no conclusive evidence that would suggest our 2fa has been compromised. People are just not submitting their log files, for whatever reason. I’m suspecting they’re somewhat scared because of potential breaches that they fear even though there’s really no reason to assume that as far as TeamViewer is concerned.
The truth of the matter is they’re just not submitting their log files and if they don’t do that we really can’t investigate their cases. Obviously, whenever we hear of claims like that we run our internal audits and look into the systems and see if we can find any bit of evidence that would suggest that yes, in fact, we have been compromised. But up to this point we have not a shred of information that would actually confirm that. We’re really asking those folks who claim that they had a problem with their 2fa, please get in touch with us, please submit your log files so we can we look into your cases.
We’re not doubting TeamViewer accounts have been abused. It’s just this is not because of a TeamViewer weakness. Like I was pointing out earlier, we have reason to believe that’s because of the reuse of passwords. Obviously, what we’re not doubting is that yes, people have been ripped off by online criminals and their bank accounts may have been emptied, but again that’s not a TeamViewer vulnerability. What we see a lot is that people still cache their credentials to their bank accounts, to their PayPal accounts, to Amazon, whatever, in their browser. There are literally lots of ways unauthorized intruders can extract that with a couple of tools that would visualize and extract the information from the browser. Also, certainly, if you grant somebody access to your device they can install malware if they mean ill or install a keylogger and that way they can pretty much get their hands on everything.
A: One of things that’s been so challenging with reporting this story is I can’t tell how many people have been breached. I don’t even know if it’s dozens, hundreds, thousands or tens of thousands. Do you have any way of estimating how many accounts have been breached?
T: Currently, I have no precise numbers. It’s a significant number. I must admit that, but I cannot attach a figure to it. Nonetheless, one is one too many to us and we’re trying to do our best to prevent them from happening in the future. Like I was pointing out earlier, we see this significant increase only after the latest data leaks that were made public in the news a couple weeks ago. Pretty much what we’re seeing is it coincides with that.
A: My understanding is that one of the ways people log in to TeamViewer is by using a machine ID and some sort of PIN. At least in that scenario you don’t have a user name and password that were exposed by MySpace or LinkedIn. Is there another way reused passwords are getting exploited?
T: You’re referring to the TeamViewer client that’s usually installed on the desktop computer. The cases that we’re talking about currently are not cases connected to that desktop client; we’re talking about TeamViewer accounts. TeamViewer offers particularly to its business clients the option of setting up TeamViewer accounts which come with a lot of advantages for professional users because it allows them to manage multiple devices, have their entire support force be in that account and set up policies that especially professional users are looking for. That’s a feature that we’re also offering to our private users who can use the accounts for free. Most of the cases to the best of my knowledge are in regards to those accounts. Whenever somebody sets up an account there are several ways they can set up their user credentials and assign devices to that account. If somebody goes ahead and uses the same e-mail and password for that account as they used for any other given Internet account then that makes this account somewhat vulnerable in terms of the credentials.
A: So once [an attacker] gets into a TeamViewer account they have a list of machines and the attacker can log into those machines?
T: Yes, if that device has been assigned to that account and access has been granted. There are a couple of policies that you can set up that would still require the use of an additional password to access those devices. Another thing I would like to stress in this context is that we’re recommending for our users to set up whitelists that will determine the only devices that can access an account. So you can say I only want to access my account from my office computer.
A: You talked [in an earlier conversation] about your regret the way you phrased some things involving the cause of the compromises. Can you talk about that?
T: We want to sincerely apologize to all users who took offense at our choice of words, particularly the “careless use” thing we published in several of our statements. We never meant to offend anyone. It’s very important for users to understand that whenever they use a tool like TeamViewer it certainly requires extra care, because what TeamViewer does and what it’s designed to do is establish a connection from one device to another and to control that device and that would pretty much put the user who takes control in a position to do virtually anything. So you want to be extra careful, and that’s what we meant to bring across. We’re deeply sorry if we offended anyone by our choice of words. It’s really important to understand that TeamViewer is a tool that needs to be used sensibly and extremely smartly.
Post your thoughts below in the comment section.
SOURCE: ARS Technica