The time is about 6:30 p.m. on May 27, and I decide to wind down for the day. I leave my home office and walk upstairs to my gaming rig, fire up some mindless hack and slash, and begin to let the day fade away. Little did I know the real action was about to begin.

How I Almost Got Hacked

In the middle of my gaming session, I lose control of my mouse and the TeamViewer window pops up in the bottom right corner of my screen. As soon as I realize what is happening, I kill the application. Then it dawns on me: I have other machines running TeamViewer!

I run downstairs where another computer is still up and running. Low and behold, the TeamViewer window shows up. Before I am able to kill it, the attacker opens a browser window and attempts to go to a new web page. As soon as I reach the machine, I revoke control and close the app. I immediately go to the TeamViewer website and change my password while also enabling two-factor authentication.

Lucky for me, those were the only two machines that were still powered on with TeamViewer installed. Also lucky for me is the fact that I was there when it occurred. Had I not been there to thwart the attack, who knows what would have been accomplished. Instead of discussing how I almost got hacked, I’d be talking about the serious implications of my personal data leak.

How Did It Happen?

At first, I thought this might have just been an isolated incident of my password being hacked. I hadn’t really used TeamViewer in a long time and had actually forgotten that it was installed on multiple systems. Then I remembered that I recently changed a few passwords in response to the LinkedIn compromise.

At this point, I figured this was most likely due to me not changing my leaked password on TeamViewer. However, being the inquisitive person that I am, I dug a little deeper.

A Reddit thread informed me that this was not isolated — and the forum clued me in on exactly what would have happened had I not been sitting there. People claimed to have had their TeamViewer accounts compromised, bank accounts drained, gift cards purchased and more.

Additional information and more reports of compromise continue to surface. At this point, TeamViewer claims that it has not been compromised, stating that the coincidental downtime was due to DNS problems and a possible distributed denial-of-service (DDoS) attack.

My speculation on the actual activity I witnessed is that it was basic recon. The attacker was simply going from one compromised machine to the next to identify who the victim was and what the timezone was, as demonstrated by the URL the attacker tried to go to.

The figure below is a screen shot of that page.

I assume the actor was planning on being in and out quickly, grabbing that little bit of information and then returning during off hours. Then he or she could bypass detection tools and wreak havoc on the victim.

Lessons Learned

Was TeamViewer breached? Did some DNS mischief take place? Is this a case of recycled passwords and simply the fallout from the compromise of LinkedIn or some other company? Hopefully more details will surface in the near future.

For the time being, take some recommendations from the story of how I almost got hacked:

  • Do not reuse passwords between applications.
  • Ensure your passwords are unique to each system.
  • Use strong and hard-to-guess passwords.
  • Change passwords frequently and use a single sign-on (SSO) tool with two-factor authentication to manage them.
  • If a product is not authorized within your corporate environment, discontinue use and uninstall.
  • If you are authorized to use a product, enable two-factor authentication for added security.
  • Keep installed applications up-to-date with the latest versions and patches.

More from X-Force

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

Threat intelligence to protect vulnerable communities

2 min read - Key members of civil society—including journalists, political activists and human rights advocates—have long been in the cyber crosshairs of well-resourced nation-state threat actors but have scarce resources to protect themselves from cyber threats. On May 14, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a High-Risk Communities Protection (HRCP) report developed through the Joint Cyber Defense Collaborative that addresses the threat to these vulnerable groups, with findings contributed by the X-Force Threat Intelligence team.Cyber criminals seek stolen credentialsThe HRCP…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today