115

So that passers-by cannot see what you are doing on your computer. If you are connecting remotely to a computer in an office, then everyone could see everything you type and you would not know. It is a basic, expected, and legitimate feature. (By the way, that's the top 8 remote desktop programs each with a "blank screen" feature for the express ...


66

Yes, it is normal for legitimate tech support to use remote support tools. It's far easier than trying to blindly walk someone through a complicated series of technical steps. Companies like TeamViewer exist because of this reason. The risks of the software are: having a persistent "back door" into a system, but there are security measures in most ...


65

Another legitimate use that hasn't been mentioned is for kiosk installations. At a previous job we operated a fair few unattended kioks and would remote into them for maintenance. Showing a blank screen to random members of the public was much better than letting them see us drag around windows, run scripts or commands on the terminal or whatever else we ...


56

You haven't actually provided enough details to say one way or the other. The fact that you didn't see an authentication prompt doesn't preclude there from being one. The remote access tools I use in my job (which also deals with HIPAA) both require me to authenticate with my domain admin credentials and do not prompt users to accept the connection, ...


43

On some CRT monitors there was a relay that was engaged when changing screen mode. By changing screen mode repeatedly very fast, it was possible to destroy this relay. Apparently some modern monitors can be wrecked by forcing them into invalid screen modes, but they must be pretty rubbish monitors. Someone has mentioned flashing the BIOS to wreck that. ...


34

I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about it The entire Internet is regularly port scanned, both by malware, attackers and researchers such as shodan.io. You can not expect any service accessible to the Internet to be unidentified for more than seconds after ...


34

Yes, they do. A key difference is that typically you have initiated the session by asking them to help you. In order to do that they may ask you to launch a remote control tool, as it's both easier than assisting you on the phone and faster and more cost-effective than bringing the device in. Commercial products available for this, e.g. TeamViewer (possibly ...


32

Take a look at this security analysis of TeamViewer. In short, it's definitely not secure on untrusted networks: https://www.optiv.com/blog/teamviewer-authentication-protocol-part-1-of-3 Conclusion: It is my recommendation that TeamViewer not be used on an untrusted network, or with the default password settings. TeamViewer does support increasing the ...


31

Running Teamviewer isn't very secure: read here To determine who was logged in - look here: C:\Program Files\TeamViewer\VersionX\Connections_incoming.txt C:\Users\XXX\AppData\Roaming\TeamViewer\Connections.txt


30

One primary non-scam feature is to allow a technician to remote in to a desktop and use authentication that should not be viewed by the user. I actually worked for an ISP where a tech actually telnetted into a Cisco router that was misbehaving via my computer remotely, and they didn't blank the screen. Back then, you could have seen the domain name, username,...


29

This used to appear in their FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and ...


28

HIPAA does not get to specifics of policy, the substance of it is that organization have to have sufficient controls in place to protect data. There's nothing inherently wrong with an unprompted takeover from a HIPAA perspective, as long as other controls (authentication, authorization, access control lists, access logging and auditing, antimalware on the ...


26

The host machine can impact and alter whatever it wishes in the guest VM. The host can read and write all the memory of the guest, stop and restart it on a per-instruction basis, and, by nature, sees every single data byte which enters or exits the guest. There is nothing which the OS in a guest VM can do to protect itself against an hostile host. Thus, if ...


21

I just want to add an answer which I think hasn't been touched upon yet. When you connect via teamviewer to another computer, you share your clipboard with that computer (by default). Therefore, everything you copy onto your clipboard is also copied onto the clipboard of the computer you are connected to. By installing a clipboard tracking application such ...


19

TeamViewer has noticed that scammers often come from India (or other places where scams often originate), and so when you get an incoming connection from India TeamViewer will give you a warning saying that this could be a scam. If the scammer can get the victim to connect to the scammer's computer first and then reverse the connection (by clicking a button ...


16

This is a good question! First a disclaimer that I'm not really qualified to give a complete answer, as I have so far been fairly good at avoiding RDP security issues in untrusted environments. I do use both RDP clients and servers though, but only ever on trusted hosts. That said, I do have a few thoughts why we're seeing such warnings; It would be fairly ...


16

It's high likely that your computer has been compromised, probably by a RAT which you caught by drive by download or email attachment. Unless you are a very technical person, I strongly advise the following: Do a malware scan on the system because the attacker probably installed more malware after entering the system (Pro tip: Live boot a Linux system and ...


16

Let's assume the worst possible attacker. And for some reason, attacking without teamviewer isn't an option (like, the SMB bug, AMT in the CPU, any 0day from that angle, deliberate backdoors from MS and US government, ...). Step 1: Using another 0day that only works if the attacker already has access to the desktop (but no admin) to get admin permissions. ...


13

It turns out my previous assumption was correct. These DDoS "attacks" are actually a side-effect of a Makost[dot]net-style botnet and is NOT the intention of the attacker (in fact, they seem specifically designed NOT to cause a disruption of service which would make us aware of their activity). The attacks are in fact trying to gain access to my servers in ...


11

Despite outrageous marketing claims to the contrary, antivirus software is not smart. Antivirus does not recognize "types" of software, as in "mmh... this looks like a tool for RAT". There are strong theoretical reasons why this sort of detection is, in all generality, impossible to achieve, and correspondingly very hard to do in practice. What antivirus ...


11

As often with security, the answer to that is "maybe". In theory, if setup right and if you're keeping your system up-to-date, RDP is actually quite secure. Possibly not the most secure system available but still it can be considered secure enough for most usage (and can be extended if necessary). The first and most relevant issue you will encounter with ...


11

The short answer is “yes, with some caveats”. The long answer is yes, but you have to ensure that prior trust has been established with the support agent by ensuring one of the points is true: You have initiated the support call. For example, you call Microsoft, Dell, HP etc. and they ask to connect to your computer. This is safe because you know who are ...


9

TeamViewer has three built-in functionalities to let user access to remote computer. They are Remote Control, File Transfer and VPN (if driver is available). None of these functions have hidden mode and again none of them lets remote user view or manage your computer without you noticing it. I see three possible attacks here: If required drivers are all ...


9

Firstly, well done for realising that you were in the middle of falling for a scam. Changing your online banking details immediately on another device was wise. After closing this app can the hackers still control my laptop? Probably not. But it is possible, if they were able to install additional software on your computer while they had access. (Since ...


8

A basic RDP client will, by default, share the clipboard through the RDP session (because it is very convenient). This alone allows the remote server to obtain a copy of everything you select and "copy" on your client, be they text excerpts, files... which is a glaring security issue when the remote host is hostile. Similarly, an hostile server may inject ...


8

Don't use the onboard NIC, which is how ME accesses the Internet. Instead, use a USB LAN device, or even one plugged into a PCI slot -- ME doesn't know how to use them!


8

Yes, your machine has been compromised by an attacker. You may have fallen for a fake "Computer Support" scam, or opened a phishing email attachment, or clicked on a bad link, or even simply been the victim of a "drive-by" malicious web site advertisement. I know TeamViewer is a common tool used by the fake support scam people; it is also used by other ...


7

All this is quite simple to work around, just turn Teredo off. From 'Accessories', run 'Command Prompt' with a right-click 'run as Administrator', then when you get the command prompt, type in: netsh interface teredo set state disable then exit and close the CMD prompt window. You will need a reboot to effect the change completely. If you find you now can'...


7

Basically it is not safe. As far as I know, they use 512-bit RSA because they mimic what Microsoft's RDP server used to do, which indeed implied a 512-bit RSA key; using something bigger would risk breaking compatibility with existing clients. Biggest issue, though, is not that the 512-bit key is weak because too short; the main problem is that, as a client, ...


7

NoMachine is more-or-less X11 over SSH with improvements in performance. So the two benefits there are that SSH is managed for you and that you don't have the ghastly performance of X11 over a network. (ISTR that SSH is not the default, but it's essentially a dropdown option, not a setup saga). VNC also provides better performance than X11, and can be ...


Only top voted, non community-wiki answers of a minimum length are eligible