Unauthorized remote control performed today - teamviewer?

Question

I came home a bit ago from an overnight trip and saw my PC screen moving around. I hoped it was just some ad animation but as I sat down I realized someone was opening 30+ tabs in my Chrome to an Apple gift card order... presumably readying them to execute all at once so I couldn't stop it once I saw the emails. Chrome has my paypal / ebay etc all saved (which I've since removed).

In any case, I unplugged my ethernet immediately. I checked whether Teamviewer was running since that's what my brain just jumped to first, and it was, so I shut it down... and then started an AVG antivirus & malwarebytes anti malware scans. AVG came up blank and malwarebytes found the following. None look particularly alarming but I have quarantined and deleted them all.

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 3
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\Toolbar.CT2790392, Quarantined, [75e390d383160a2c20f0c20dae55ee12], 
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Toolbar.CT2790392, Quarantined, [ca8ebfa417828aac8b85d5fade250ef2], 
PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\APPDATALOW\SOFTWARE\BitTorrentBar, Quarantined, [6bed1251e9b0c0769c3e01d8d33045bb], 

Registry Values: 4
PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{88C7F2AA-F93F-432C-8F0E-B7D85967A527}, Quarantined, [b7a1ce95277247efb137029d10f25aa6], 
PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{88C7F2AA-F93F-432C-8F0E-B7D85967A527}, ªòLj?ù,C ·ØYg¥', Quarantined, [b7a1ce95277247efb137029d10f25aa6]
PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{88C7F2AA-F93F-432C-8F0E-B7D85967A527}, Quarantined, [b7a1ce95277247efb137029d10f25aa6], 
PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}, Quarantined, [eb6d174c5c3d2d0995535b4404fefc04], 

Registry Data: 0
(No malicious items detected)

Folders: 10
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Feeds, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Log, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Toolbar, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Toolbar\Facebook, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 

Files: 25
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\DynamicDialogs.zip, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\DialogsAPI.js, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\PIE.htc, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\settings.js, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\version.txt, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\AppNotification.js, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\initialNotification.html, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\main.html, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyle.css, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\sampleNotification.html, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\close.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\like.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next_hover.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\powered-by.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev_hover.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\settings.png, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Thumbs.db, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1182482_1178159_DK.xml, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks\en.xml, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=6_8_5_1.xml, Quarantined, [98c098cb613863d3f11159aa62a1fe02], 
PUP.Optional.PCKeeper, C:\Users\Andrew\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_app.pckeeper.com_0.localstorage, Quarantined, [f860293a1584fc3a17832c2d5ba9b14f], 
PUP.Optional.PCKeeper, C:\Users\Andrew\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_app.pckeeper.com_0.localstorage-journal, Quarantined, [2d2b30338a0fd3632d6ddf7a699bb050], 

Next I checked my teamviewer log, and found some funny business around 2/21 14:35:35. It looks like the teamviewer software updated and not too long after, a connection was made. Until 14:43:07, when I unplugged the ethernet cord and the log shows LAN disconnected. Full log in pastebin here.

http://pastebin.com/eYNqkE4y

My question... I have not really been attacked like this before. I have changed and complexified my primary passwords but with remote access to my PC it is quite frightening how much the intruder could have done. Is this most likely an intrusion using a weak teamviewer password? Or did they have access to my machine to install/update teamviewer in some funny way (I already had it installed) that allowed them to connect?

Appreciate any advice - feeling a bit vulnerable at the moment!

Answer 1

First, disconnecting the Ethernet was a wise choice. I'd also disconnect your router for the time being.

As far as figuring out how they got in, running an IDS/IPS and looking at those logs would be valuable in the future; looking back, the offline scans below will at least point out some possible infection vectors, as well checking for router vulnerabilities.

I recommend you do the following:

• Unplug your router from the Internet in addition to your PC:

• Buy a new one

• Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

  • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

  • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

  • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

    • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.

  • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

• Change all your passwords everywhere

• Use something like KeePass to generate long random ones for each service.

• Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

• Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

• Buy a new hard drive

• Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

• Install Windows from scratch

• Install your AV package with an offline installer downloaded on a noncompromised computer and network

• Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

• Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

  • Wrap the compromised hard drive in the small kitchen towel

  • Put the wrapped HD in at least 6 Ziplock bags, each sealed

  • Smash the drive with the sledgehammer until glass shards are leaking through the towel

  • Restore your valuable data from existing backups

• Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

  - Regardless, do these offline scans for all other machines on your network!
  
  - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
  
  - at least one of AVG and Avira (or both)
  
  - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
  
  - Comodo Rescue Disk (it advertises rootkit scanning, too)
  
  - Pick another couple of your favorites.
  

  • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

  • If you're truly worried, do this on every machine on the network.

    • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.

  • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

• Set up Teamviewer Two Factor Authentication, which uses the TOTP protocol (time based one time passwords); RFC6238.

After all of this, once you're fully online again

• Make sure your OS is patched, and stays patched.

• Make sure your router is patched, and stays patched.

• Make sure your TeamViewer is patched, and stays patched.

• And is DISABLED whenever you're not planning to use it!

• And your router limits the places you can get in from

  • pfSense and the Edgerouter Lite can both set up VPNs of a variety of types. Use a certificate based one, regardless.

• Make sure your antivirus is patched and up to date, and stays that way

• Make sure your (new) firewall is patched and up to date.

Answer 2

The possibility of your TeamViewer to be bruteforce-attacked is kind of low, as they have been covered against those kind of attacks, as stated here: http://www.riskmanagementstudio.com/images/stories/rmstudio/Remote_Support/TeamViewer_SecurityStatement.pdf (Page 5)

Anyway, that should not be discarded, if you had one extremely easy guessable password (like "12345678"), you might be randomly hit by one automated attack.

The option of being compromised by any kind of malware is much more likely.

The most "professional" answer for your case might be: "Consider everything as compromised and build your system from scratch", as runelynx said.

Consider your computer compromised, backup your files and get sure that no malware is carried out with the backups.

Also, it will be great if you contact the TeamViewer team (support[at] teamviewer.com) and ask them about your incident (it's great that you had logs), just in case they can provide you with information about any other similar case so you will know what was the root cause and how to proceed.

Good luck !

Edit: I forgot to say. Map the creation date and modification for the files that AVG and MalwareBytes found to the time of your incident, so you can see if they are related to the intrusion or not ;)