Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm deploying a web-based ERP system for a customer, such that both the server and the client machines will be inside the customer's intranet. I was advised in another question not to use TeamViewer to access the server, using more secure means instead, and so did I. But now I'm concerned about whether or not TeamViewer would be appropriate for the client machines, which are not "special" to this system in particular, but nonetheless I don't want to lower their current security, neither I want to compromise the computer on my end.

My question, then, is whether or not TeamViewer is "good enough" for simple remote desktop support, where it will be used simply to assist the users in the usage of the system, and whether or not I must take additional measures (like changing the default settings, changing the firewall, etc) to reach a satisfactory level or security.

Some details:

  1. I already read the company's security statement and in my non-expert opinion all's fine. However, this answer in that other question has put me in doubt. After some research, UPnP in particular does not worry me anymore, since the feature that uses it - DirectIn - is disabled by default. But I wonder if there are more things I should be aware of that's not covered in that document.

  2. The Wikipedia article about TeamViewer says the Linux port uses Wine. AFAIK that doesn't affect it's network security, is that correct?

  3. Ultimatly, the responsibility of securing my customers' networks is not mine, it's theirs. But I need to advise them about the possibilities of setting up this system, in particular because most of them are small-medium NGOs without any IT staff of their own. Often I won't be able to offer an "ideal" setup, but at least I wanna be able to give advice like: "if you're installing TeamViewer in this machine, you won't be able to do X, Y and Z in it, because I'll disable it"; or: "you can install TeamViewer in any regular machine you want, it's safe in its default configuration; only this one *points to server* is off-limits".

  4. My choice of TeamViewer was solely because it was straightforward to install in both Windows and Linux machines, and it just works (its cost is accessible too). But I'm open for other suggestions. I'm low both in budget and specialized staff, so I'm going for the simpler tools, but I wanna make a conscious decision whatever that is.

share|improve this question
1  
I prefer a self-destructing, on-demand solution like join.me. –  Iszi Feb 29 '12 at 13:15
1  
Join.me is a Logmein service that isn't exactly linux friendly. Something to keep in mind if you aren't in love with wine. –  Joel Feb 27 '13 at 22:51
    
@Joel I'm in love with wine, although I find mixing it with work makes me incredibly unproductive –  deed02392 Aug 18 '13 at 11:14
    
I would recommend deploying on premise RHUB remote support appliances. They work from behind your company’s firewall, hence are much secured as compared to hosted services. –  user32972 Nov 8 '13 at 9:50
    
UltraVNC offers a self-destructing client-initiated connection tool that's VNC compatible as well for remote-viewing Windows clients. –  mikebabcock Dec 6 '13 at 17:10

9 Answers 9

up vote 22 down vote accepted

There's a couple of differences between using a 3rd party supplier (such as teamviewer) and a direct remote control solution (eg, VNC)

Team Viewer has advantages in that it doesn't require ports to be opened on the firewall for inbound connections, which removes a potential point of attack. For example if you have something like VNC listening (and it isn't possible to restrict source IP addresses for connections) then if there is a security vulnerability in VNC, or a weak password is used, then there is a risk that an attacker could use this mechanism to attack your customer.

However there is a trade-off for this, which is that you're providing a level of trust to the people who create and run the service (in this case teamviewer). If their product or servers are compromised, then it's possible that an attacker would be able to use that to attack anyone using the service. One thing to consider is that if you're a paying customer of the service, you may have some contractual come-back if they're hacked (although that's very likely to depend on the service in question and a whole load of other factors)

Like everything in security it's a trade-off. If you have a decently secure remote control product and manage and control it well then I'd be inclined to say that that's likely to be a more secure option than relying on a 3rd party of any kind.

That said if the claims on TeamViewers website are accurate it seems likely that they're paying a fair degree of attention to security, and also you could consider that if someone hacks TeamViewer (who have a pretty large number of customers) what's the chance that they'll attack you :)

share|improve this answer
    
Very insightful! Right now I'm inclined to trust TeamViewer, my own lack of expertise on this subject might make a custom solution more risky than a ready-made one, short term (as long as that solution is a good one, naturally). But I'll make sure to weight those arguments in my future strategy. –  mgibsonbr Feb 28 '12 at 22:00
    
+1 for "everything in security is a trade-off". This is an answer to many questions –  Shurmajee Apr 4 '13 at 4:42

I just want to add an answer which I think hasn't been touched upon yet. When you connect via teamviewer to another computer, you share your clipboard with that computer (by default).

Therefore, everything you copy onto your clipboard is also copied onto the clipboard of the computer you are connected to. By installing a clipboard tracking application such as ClipDiary, on the host computer, you can keep a record of everything copied onto the clipboard by the person connecting to you.

Most of the answers here are focusing on the security of the computer being used as the host, but this is also a potential security issue for the computer connecting to the host, especially if you use a password management tool such as KeePass, as the host computer could potentially have a record of usernames and passwords (and potentially URL's if you also copy the URL from KeePass to your browser) on the clipboard history after your session is over.

share|improve this answer
2  
Good point! It's very easy to forget this detail, and you never know what is in the clipboard at any moment, since it's invisible... so I'd rather play it safe and disable this option. –  mgibsonbr May 3 '13 at 23:56

I don't know enough about TeamViewer to give you an assessment of its risks or whether it is a good choice for your situation. But I'm going to re-iterate a comment from @Lie Ryan. If you deploy TeamViewer for this purpose, one potential way to reduce the risk of remote attacks is to set up a firewall (on both endpoints) which blocks all access to the TeamViewer ports except from authorized machines.

share|improve this answer
    
TeamViewer uses port 80 outgoing on both ends. I don't know if it uses end-to-end encryption or if the TeamViewer-company can see/modify the traffic on their relay servers. –  Hendrik Brummermann Feb 26 '12 at 17:28
1  
The webpage claims that they use end-to-end encryption using public/private key cryptography, so that the routing servers cannot decrypt the traffic. But it does not go into details how the trust of the public key is managed. –  Hendrik Brummermann Feb 26 '12 at 17:32
    
@HendrikBrummermann "does not go into details how the trust of the public key is managed" - according to this answer, not very well... –  mgibsonbr Jun 1 '13 at 9:53

Take a look at this security analysis of TeamViewer. In short, it's definitely not secure on untrusted networks: http://blog.accuvantlabs.com/blog/bthomas/teamviewer-authentication-protocol

share|improve this answer
1  
That's pretty good info, I wish I could upvote you more than once! I'd just like to note that many of the dangers presented in the linked page can be mitigated by not leaving TeamViewer running unsupervised, instead only opening it when you need to, and closing it immediatly after use. That won't protect you against an eavesdropper, but if you can [as is in my case] you can also disable remote control, so an active attacker won't be able to do much damage. –  mgibsonbr Jun 1 '13 at 9:47
    
@mgibsonbr: You can use the SE bounty mechanism to donate some of your rep to Bill for his answer. –  Warren Young Sep 25 '13 at 15:38

About TeamViewer, there are a couple things that I think you should keep in mind:

  • You can't easily look at the source and verify its security, and it's a network-facing attack surface. That's not so nice – if you're able to make an OpenSSH server with password-based auth deactivated the internet-facing part instead, do that. (You might want to give the user a method to start/stop the server.) Through the OpenSSH tunnel, you could just use localhost-bound VNC to connect to the display. Of course, this method doesn't work so well if the PCs in question are behind a NAT/overzealous Firewall and you don't have a way to get behind that firewall. Ideas to get around it:
    • You could use a hack like http://samy.pl/pwnat/ to open them up to connections from the internet.
    • You could do the SSH tunnel in the reverse direction: When they want support, they start a script that makes an SSH tunnel to your support server and connects a TCP connection to the VNC server to the SSH connection. Your support server has the client's public key in its authorized_keys file with a forced command that connects the client to your reverse VNC client.
  • If you use it, make sure to never have a system running with that stupid 4-digit passcode system. Yes, they do have exponential lockout times, but first thing, you don't want support to be locked out that easily and second thing, well, what if someone just tries one random combination on 100000 PC running teamviewer? He'll get ~100 established connections without running into any lockout, I think – afaik, the lockout is completely client-side.
share|improve this answer
1  
A quick analysis by a third party shows its quite insecure in fact: blog.accuvant.com/bthomasaccuvant/… –  mikebabcock Dec 6 '13 at 17:12

Teamviewer is not secure period. Think about it. Teamviewer can be configured to always use the same Partner ID and password. Similar code can be created and launched just by the user clicking on an email. Great tool? Absolutely..for guys like me who support a large bunch of remote users who can't tell a colon from a semi-colon. But secure? No way No how. Teamviewer allows remote access to a PC and can circumvent Cisco VPN or any other VPN security. This crap about the end user having to give out the partner ID and pass is just that...crap. This can be gotten around very easily. Don't get me wrong. I like Teamviewer. But don't kid yourself, it's not secure at all.

share|improve this answer

I would suggest a native solution such as VNC, enabling you to omit such workarounds as TeamViewer in WINE etc, as well as using the local operating systems package management utility to ensure that the solution stays up to date. For security, use an SSH tunnel. This ensures that all VNC communications are encrypted, including the initial VNC auth/password handshake. This is especially important as a lot of VNC implementations are rather insecure.

In addition as another respondant suggested, use IP filtering to ensure that only those at certain addresses are able to communicate with the VNC server.

share|improve this answer
    
If you this route you could also in theory extend the support to external clients through the use of a VPN. Much easier to block everyone except a list, then try to worry about everyone, and try to secure the network. –  Ramhound Mar 1 '12 at 14:47

One way we handle it: if client requests TeamViewer availability, user starts TeamViewer on demand and admin kills it upon tasks completion. Another solution we once deployed in such a case, is that TeamViewer is started from an SSH session by the admin. Alternatively, you might look into "invite-me" desktop sharing tools. Or my favorite: mirroring the Xsession via SSH to your desktop.

share|improve this answer

Teamviewer gives the computer user the ability to give a remote session to is PC to anyone in the internet. So, the security of the network passes to the end-user! That's a no-go. I advise you to use VNC.

share|improve this answer
    
Some references, or more detail on the how might help the poster. –  Mark C. Wallace Oct 11 '12 at 12:49
    
"the security of the network passes to the end-user" - I disagree. TeamViewer by itself does not perform any privilege escalation, so the remote operator can only do as much as the local user could do. There might be other reasons why another choice of tools might be better, but IMHO this is not one of them (the user either has or has not the authority to allow a remote operator, the specific tool being irrelevant). –  mgibsonbr Oct 29 '12 at 20:01

protected by Lucas Kauffman Jan 8 at 19:28

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.