The time is about 6:30 p.m. on May 27, and I decide to wind down for the day. I leave my home office and walk upstairs to my gaming rig, fire up some mindless hack and slash, and begin to let the day fade away. Little did I know the real action was about to begin.

How I Almost Got Hacked

In the middle of my gaming session, I lose control of my mouse and the TeamViewer window pops up in the bottom right corner of my screen. As soon as I realize what is happening, I kill the application. Then it dawns on me: I have other machines running TeamViewer!

I run downstairs where another computer is still up and running. Low and behold, the TeamViewer window shows up. Before I am able to kill it, the attacker opens a browser window and attempts to go to a new web page. As soon as I reach the machine, I revoke control and close the app. I immediately go to the TeamViewer website and change my password while also enabling two-factor authentication.

Lucky for me, those were the only two machines that were still powered on with TeamViewer installed. Also lucky for me is the fact that I was there when it occurred. Had I not been there to thwart the attack, who knows what would have been accomplished. Instead of discussing how I almost got hacked, I’d be talking about the serious implications of my personal data leak.

How Did It Happen?

At first, I thought this might have just been an isolated incident of my password being hacked. I hadn’t really used TeamViewer in a long time and had actually forgotten that it was installed on multiple systems. Then I remembered that I recently changed a few passwords in response to the LinkedIn compromise.

At this point, I figured this was most likely due to me not changing my leaked password on TeamViewer. However, being the inquisitive person that I am, I dug a little deeper.

A Reddit thread informed me that this was not isolated — and the forum clued me in on exactly what would have happened had I not been sitting there. People claimed to have had their TeamViewer accounts compromised, bank accounts drained, gift cards purchased and more.

Additional information and more reports of compromise continue to surface. At this point, TeamViewer claims that it has not been compromised, stating that the coincidental downtime was due to DNS problems and a possible distributed denial-of-service (DDoS) attack.

My speculation on the actual activity I witnessed is that it was basic recon. The attacker was simply going from one compromised machine to the next to identify who the victim was and what the timezone was, as demonstrated by the URL the attacker tried to go to.

The figure below is a screen shot of that page.

I assume the actor was planning on being in and out quickly, grabbing that little bit of information and then returning during off hours. Then he or she could bypass detection tools and wreak havoc on the victim.

Lessons Learned

Was TeamViewer breached? Did some DNS mischief take place? Is this a case of recycled passwords and simply the fallout from the compromise of LinkedIn or some other company? Hopefully more details will surface in the near future.

For the time being, take some recommendations from the story of how I almost got hacked:

  • Do not reuse passwords between applications.
  • Ensure your passwords are unique to each system.
  • Use strong and hard-to-guess passwords.
  • Change passwords frequently and use a single sign-on (SSO) tool with two-factor authentication to manage them.
  • If a product is not authorized within your corporate environment, discontinue use and uninstall.
  • If you are authorized to use a product, enable two-factor authentication for added security.
  • Keep installed applications up-to-date with the latest versions and patches.

More from Software Vulnerabilities

X-Force Prevents Zero Day from Going Anywhere

8 min read - This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…

8 min read

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

12 min read - ‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

12 min read

Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers

17 min read - Overview In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities. Over the last few years, public accounts have increasingly shown that less sophisticated attackers are using this technique to achieve their objectives. It is therefore important that we put a spotlight on this capability and learn more about its potential impact. Specifically, in this post, we will evaluate how Kernel post-exploitation can be used…

17 min read

Dissecting and Exploiting TCP/IP RCE Vulnerability “EvilESP”

10 min read - September’s Patch Tuesday unveiled a critical remote vulnerability in tcpip.sys, CVE-2022-34718. The advisory from Microsoft reads: “An unauthenticated attacker could send a specially crafted IPv6 packet to a Windows node where IPsec is enabled, which could enable a remote code execution exploitation on that machine.” Pure remote vulnerabilities usually yield a lot of interest, but even over a month after the patch, no additional information outside of Microsoft’s advisory had been publicly published. From my side, it had been a…

10 min read