The time is about 6:30 p.m. on May 27, and I decide to wind down for the day. I leave my home office and walk upstairs to my gaming rig, fire up some mindless hack and slash, and begin to let the day fade away. Little did I know the real action was about to begin.

How I Almost Got Hacked

In the middle of my gaming session, I lose control of my mouse and the TeamViewer window pops up in the bottom right corner of my screen. As soon as I realize what is happening, I kill the application. Then it dawns on me: I have other machines running TeamViewer!

I run downstairs where another computer is still up and running. Low and behold, the TeamViewer window shows up. Before I am able to kill it, the attacker opens a browser window and attempts to go to a new web page. As soon as I reach the machine, I revoke control and close the app. I immediately go to the TeamViewer website and change my password while also enabling two-factor authentication.

Lucky for me, those were the only two machines that were still powered on with TeamViewer installed. Also lucky for me is the fact that I was there when it occurred. Had I not been there to thwart the attack, who knows what would have been accomplished. Instead of discussing how I almost got hacked, I’d be talking about the serious implications of my personal data leak.

How Did It Happen?

At first, I thought this might have just been an isolated incident of my password being hacked. I hadn’t really used TeamViewer in a long time and had actually forgotten that it was installed on multiple systems. Then I remembered that I recently changed a few passwords in response to the LinkedIn compromise.

At this point, I figured this was most likely due to me not changing my leaked password on TeamViewer. However, being the inquisitive person that I am, I dug a little deeper.

A Reddit thread informed me that this was not isolated — and the forum clued me in on exactly what would have happened had I not been sitting there. People claimed to have had their TeamViewer accounts compromised, bank accounts drained, gift cards purchased and more.

Additional information and more reports of compromise continue to surface. At this point, TeamViewer claims that it has not been compromised, stating that the coincidental downtime was due to DNS problems and a possible distributed denial-of-service (DDoS) attack.

My speculation on the actual activity I witnessed is that it was basic recon. The attacker was simply going from one compromised machine to the next to identify who the victim was and what the timezone was, as demonstrated by the URL the attacker tried to go to.

The figure below is a screen shot of that page.

I assume the actor was planning on being in and out quickly, grabbing that little bit of information and then returning during off hours. Then he or she could bypass detection tools and wreak havoc on the victim.

Lessons Learned

Was TeamViewer breached? Did some DNS mischief take place? Is this a case of recycled passwords and simply the fallout from the compromise of LinkedIn or some other company? Hopefully more details will surface in the near future.

For the time being, take some recommendations from the story of how I almost got hacked:

• Do not reuse passwords between applications.
• Ensure your passwords are unique to each system.
• Use strong and hard-to-guess passwords.
• Change passwords frequently and use a single sign-on (SSO) tool with two-factor authentication to manage them.
• If a product is not authorized within your corporate environment, discontinue use and uninstall.
• If you are authorized to use a product, enable two-factor authentication for added security.
• Keep installed applications up-to-date with the latest versions and patches.