The time is about 6:30 p.m. on May 27, and I decide to wind down for the day. I leave my home office and walk upstairs to my gaming rig, fire up some mindless hack and slash, and begin to let the day fade away. Little did I know the real action was about to begin.

How I Almost Got Hacked

In the middle of my gaming session, I lose control of my mouse and the TeamViewer window pops up in the bottom right corner of my screen. As soon as I realize what is happening, I kill the application. Then it dawns on me: I have other machines running TeamViewer!

I run downstairs where another computer is still up and running. Low and behold, the TeamViewer window shows up. Before I am able to kill it, the attacker opens a browser window and attempts to go to a new web page. As soon as I reach the machine, I revoke control and close the app. I immediately go to the TeamViewer website and change my password while also enabling two-factor authentication.

Lucky for me, those were the only two machines that were still powered on with TeamViewer installed. Also lucky for me is the fact that I was there when it occurred. Had I not been there to thwart the attack, who knows what would have been accomplished. Instead of discussing how I almost got hacked, I’d be talking about the serious implications of my personal data leak.

How Did It Happen?

At first, I thought this might have just been an isolated incident of my password being hacked. I hadn’t really used TeamViewer in a long time and had actually forgotten that it was installed on multiple systems. Then I remembered that I recently changed a few passwords in response to the LinkedIn compromise.

At this point, I figured this was most likely due to me not changing my leaked password on TeamViewer. However, being the inquisitive person that I am, I dug a little deeper.

A Reddit thread informed me that this was not isolated — and the forum clued me in on exactly what would have happened had I not been sitting there. People claimed to have had their TeamViewer accounts compromised, bank accounts drained, gift cards purchased and more.

Additional information and more reports of compromise continue to surface. At this point, TeamViewer claims that it has not been compromised, stating that the coincidental downtime was due to DNS problems and a possible distributed denial-of-service (DDoS) attack.

My speculation on the actual activity I witnessed is that it was basic recon. The attacker was simply going from one compromised machine to the next to identify who the victim was and what the timezone was, as demonstrated by the URL the attacker tried to go to.

The figure below is a screen shot of that page.


I assume the actor was planning on being in and out quickly, grabbing that little bit of information and then returning during off hours. Then he or she could bypass detection tools and wreak havoc on the victim.

Lessons Learned

Was TeamViewer breached? Did some DNS mischief take place? Is this a case of recycled passwords and simply the fallout from the compromise of LinkedIn or some other company? Hopefully more details will surface in the near future.

For the time being, take some recommendations from the story of how I almost got hacked:

  • Do not reuse passwords between applications.
  • Ensure your passwords are unique to each system.
  • Use strong and hard-to-guess passwords.
  • Change passwords frequently and use a single sign-on (SSO) tool with two-factor authentication to manage them.
  • If a product is not authorized within your corporate environment, discontinue use and uninstall.
  • If you are authorized to use a product, enable two-factor authentication for added security.
  • Keep installed applications up-to-date with the latest versions and patches.

More from X-Force

FYSA – Critical RCE Flaw in GNU-Linux Systems

2 min read - Summary The first of a series of blog posts has been published detailing a vulnerability in the Common Unix Printing System (CUPS), which purportedly allows attackers to gain remote access to UNIX-based systems. The vulnerability, which affects various UNIX-based operating systems, can be exploited by sending a specially crafted HTTP request to the CUPS service. Threat Topography Threat Type: Remote code execution vulnerability in CUPS service Industries Impacted: UNIX-based systems across various industries, including but not limited to, finance, healthcare,…

Getting “in tune” with an enterprise: Detecting Intune lateral movement

13 min read - Organizations continue to implement cloud-based services, a shift that has led to the wider adoption of hybrid identity environments that connect on-premises Active Directory with Microsoft Entra ID (formerly Azure AD). To manage devices in these hybrid identity environments, Microsoft Intune (Intune) has emerged as one of the most popular device management solutions. Since this trusted enterprise platform can easily be integrated with on-premises Active Directory devices and services, it is a prime target for attackers to abuse for conducting…

You just got vectored – Using Vectored Exception Handlers (VEH) for defense evasion and process injection

10 min read - Vectored Exception Handlers (VEH) have received a lot of attention from the offensive security industry in recent years, but VEH has been used in malware for well over a decade now. VEH provides developers with an easy way to catch exceptions and modify register contexts, so naturally, they’re a ripe target for malware developers. For all the attention they’ve received, nobody had publicized a way to manually add a Vectored Exception Handler without relying on the built-in Windows APIs which…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today