The time is about 6:30 p.m. on May 27, and I decide to wind down for the day. I leave my home office and walk upstairs to my gaming rig, fire up some mindless hack and slash, and begin to let the day fade away. Little did I know the real action was about to begin.

How I Almost Got Hacked

In the middle of my gaming session, I lose control of my mouse and the TeamViewer window pops up in the bottom right corner of my screen. As soon as I realize what is happening, I kill the application. Then it dawns on me: I have other machines running TeamViewer!

I run downstairs where another computer is still up and running. Low and behold, the TeamViewer window shows up. Before I am able to kill it, the attacker opens a browser window and attempts to go to a new web page. As soon as I reach the machine, I revoke control and close the app. I immediately go to the TeamViewer website and change my password while also enabling two-factor authentication.

Lucky for me, those were the only two machines that were still powered on with TeamViewer installed. Also lucky for me is the fact that I was there when it occurred. Had I not been there to thwart the attack, who knows what would have been accomplished. Instead of discussing how I almost got hacked, I’d be talking about the serious implications of my personal data leak.

How Did It Happen?

At first, I thought this might have just been an isolated incident of my password being hacked. I hadn’t really used TeamViewer in a long time and had actually forgotten that it was installed on multiple systems. Then I remembered that I recently changed a few passwords in response to the LinkedIn compromise.

At this point, I figured this was most likely due to me not changing my leaked password on TeamViewer. However, being the inquisitive person that I am, I dug a little deeper.

A Reddit thread informed me that this was not isolated — and the forum clued me in on exactly what would have happened had I not been sitting there. People claimed to have had their TeamViewer accounts compromised, bank accounts drained, gift cards purchased and more.

Additional information and more reports of compromise continue to surface. At this point, TeamViewer claims that it has not been compromised, stating that the coincidental downtime was due to DNS problems and a possible distributed denial-of-service (DDoS) attack.

My speculation on the actual activity I witnessed is that it was basic recon. The attacker was simply going from one compromised machine to the next to identify who the victim was and what the timezone was, as demonstrated by the URL the attacker tried to go to.

The figure below is a screen shot of that page.

I assume the actor was planning on being in and out quickly, grabbing that little bit of information and then returning during off hours. Then he or she could bypass detection tools and wreak havoc on the victim.

Lessons Learned

Was TeamViewer breached? Did some DNS mischief take place? Is this a case of recycled passwords and simply the fallout from the compromise of LinkedIn or some other company? Hopefully more details will surface in the near future.

For the time being, take some recommendations from the story of how I almost got hacked:

  • Do not reuse passwords between applications.
  • Ensure your passwords are unique to each system.
  • Use strong and hard-to-guess passwords.
  • Change passwords frequently and use a single sign-on (SSO) tool with two-factor authentication to manage them.
  • If a product is not authorized within your corporate environment, discontinue use and uninstall.
  • If you are authorized to use a product, enable two-factor authentication for added security.
  • Keep installed applications up-to-date with the latest versions and patches.

More from Software Vulnerabilities

Dissecting and Exploiting TCP/IP RCE Vulnerability “EvilESP”

September’s Patch Tuesday unveiled a critical remote vulnerability in tcpip.sys, CVE-2022-34718. The advisory from Microsoft reads: “An unauthenticated attacker could send a specially crafted IPv6 packet to a Windows node where IPsec is enabled, which could enable a remote code execution exploitation on that machine.” Pure remote vulnerabilities usually yield a lot of interest, but even over a month after the patch, no additional information outside of Microsoft’s advisory had been publicly published. From my side, it had been a…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…

Critical Remote Code Execution Vulnerability in SPNEGO Extended Negotiation Security Mechanism

In September 2022, Microsoft patched an information disclosure vulnerability in SPNEGO NEGOEX (CVE-2022-37958). On December 13, Microsoft reclassified the vulnerability as “Critical” severity after IBM Security X-Force Red Security Researcher Valentina Palmiotti discovered the vulnerability could allow attackers to remotely execute code. The vulnerability is in the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism, which allows a client and server to negotiate the choice of security mechanism to use. This vulnerability is a pre-authentication remote code execution vulnerability impacting a wide…

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…