56

You haven't actually provided enough details to say one way or the other. The fact that you didn't see an authentication prompt doesn't preclude there from being one. The remote access tools I use in my job (which also deals with HIPAA) both require me to authenticate with my domain admin credentials and do not prompt users to accept the connection, ...


43

On some CRT monitors there was a relay that was engaged when changing screen mode. By changing screen mode repeatedly very fast, it was possible to destroy this relay. Apparently some modern monitors can be wrecked by forcing them into invalid screen modes, but they must be pretty rubbish monitors. Someone has mentioned flashing the BIOS to wreck that. ...


34

I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about it The entire Internet is regularly port scanned, both by malware, attackers and researchers such as shodan.io. You can not expect any service accessible to the Internet to be unidentified for more than seconds after ...


32

There's a couple of differences between using a 3rd party supplier (such as teamviewer) and a direct remote control solution (eg, VNC) Team Viewer has advantages in that it doesn't require ports to be opened on the firewall for inbound connections, which removes a potential point of attack. For example if you have something like VNC listening (and it isn't ...


31

Running Teamviewer isn't very secure: read here To determine who was logged in - look here: C:\Program Files\TeamViewer\VersionX\Connections_incoming.txt C:\Users\XXX\AppData\Roaming\TeamViewer\Connections.txt


29

Take a look at this security analysis of TeamViewer. In short, it's definitely not secure on untrusted networks: https://www.optiv.com/blog/teamviewer-authentication-protocol-part-1-of-3 Conclusion: It is my recommendation that TeamViewer not be used on an untrusted network, or with the default password settings. TeamViewer does support increasing the ...


28

HIPAA does not get to specifics of policy, the substance of it is that organization have to have sufficient controls in place to protect data. There's nothing inherently wrong with an unprompted takeover from a HIPAA perspective, as long as other controls (authentication, authorization, access control lists, access logging and auditing, antimalware on the ...


24

The host machine can impact and alter whatever it wishes in the guest VM. The host can read and write all the memory of the guest, stop and restart it on a per-instruction basis, and, by nature, sees every single data byte which enters or exits the guest. There is nothing which the OS in a guest VM can do to protect itself against an hostile host. Thus, if ...


24

From their own FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and OCB, and we ...


22

To elaborate on ewanm89's post, TeamViewer does use UDP pinholeing. UDP is a stateless protocol. This means packets are fired off at their target with no verification (at the protocol level) that they were received or even reached the destination. Firewalls are designed to look for UDP packets and record the source and destination as well as the timestamp. ...


19

I just want to add an answer which I think hasn't been touched upon yet. When you connect via teamviewer to another computer, you share your clipboard with that computer (by default). Therefore, everything you copy onto your clipboard is also copied onto the clipboard of the computer you are connected to. By installing a clipboard tracking application such ...


16

It's high likely that your computer has been compromised, probably by a RAT which you caught by drive by download or email attachment. Unless you are a very technical person, I strongly advise the following: Do a malware scan on the system because the attacker probably installed more malware after entering the system (Pro tip: Live boot a Linux system and ...


16

Let's assume the worst possible attacker. And for some reason, attacking without teamviewer isn't an option (like, the SMB bug, AMT in the CPU, any 0day from that angle, deliberate backdoors from MS and US government, ...). Step 1: Using another 0day that only works if the attacker already has access to the desktop (but no admin) to get admin permissions. ...


15

This is a good question! First a disclaimer that I'm not really qualified to give a complete answer, as I have so far been fairly good at avoiding RDP security issues in untrusted environments. I do use both RDP clients and servers though, but only ever on trusted hosts. That said, I do have a few thoughts why we're seeing such warnings; It would be fairly ...


13

It turns out my previous assumption was correct. These DDoS "attacks" are actually a side-effect of a Makost[dot]net-style botnet and is NOT the intention of the attacker (in fact, they seem specifically designed NOT to cause a disruption of service which would make us aware of their activity). The attacks are in fact trying to gain access to my servers in ...


12

When you say "Welcome" screen with all users listed. Is that so, or is it one named user and then "Other user"? If it is one named user and "Other user" then the named user is actually coming from the RDP client and is not being exposed. Depending on which client you are connecting with, but at least the Win XP client will save last connected user on the ...


11

Very frightening! As a risk, this should be raised to the board - effectively an attacker on the internet only needs to find out that username and password (or an SSH 0-day) and your entire corporate network should be considered compromised. Could the business run without it? Is there anything sensitive on it? This is a bad idea in so many ways: It ...


11

Despite outrageous marketing claims to the contrary, antivirus software is not smart. Antivirus does not recognize "types" of software, as in "mmh... this looks like a tool for RAT". There are strong theoretical reasons why this sort of detection is, in all generality, impossible to achieve, and correspondingly very hard to do in practice. What antivirus ...


10

As often with security, the answer to that is "maybe". In theory, if setup right and if you're keeping your system up-to-date, RDP is actually quite secure. Possibly not the most secure system available but still it can be considered secure enough for most usage (and can be extended if necessary). The first and most relevant issue you will encounter with ...


10

Firstly, well done for realising that you were in the middle of falling for a scam. Changing your online banking details immediately on another device was wise. After closing this app can the hackers still control my laptop? Probably not. But it is possible, if they were able to install additional software on your computer while they had access. (Since ...


9

By "open on their router" I assume you mean open to the Internet. I'd advise against this. Remote Desktop Protocol is susceptible to known attacks. Also you say "patched", but even as recently as last week Microsoft issued a security bulletin against RDP: This security update resolves two privately reported vulnerabilities in the Remote Desktop Protocol....


8

It all comes down to the threat model. It depends on the risks and the likelihood of an attack. It depends on what the workstation does. It depends on the clients involved. How is this any different from running SSH on an actual server? If the service account doesn't have permissions to do much then the attack can't get very far. If the service account ...


8

A basic RDP client will, by default, share the clipboard through the RDP session (because it is very convenient). This alone allows the remote server to obtain a copy of everything you select and "copy" on your client, be they text excerpts, files... which is a glaring security issue when the remote host is hostile. Similarly, an hostile server may inject ...


8

Yes, your machine has been compromised by an attacker. You may have fallen for a fake "Computer Support" scam, or opened a phishing email attachment, or clicked on a bad link, or even simply been the victim of a "drive-by" malicious web site advertisement. I know TeamViewer is a common tool used by the fake support scam people; it is also used by other ...


7

You shouldn't be worried about it. It looks as if Teredo is a IPv6 tunneling technology. According to this Wikipedia article it allows for IPv6 connectivity by tunneling IPv6 packets through your router encapsulated in IPv4/UDP datagrams (so you can still talk IPv6 even though your router doesn't).


7

Update: The question has since it was originally posted been edited to highlight one difference, namely that RDP v6 over TLS is used. While the answer may still be considered "okay", I must now argue that tunneling TLS over SSH is unnecessary due to a lack of relevant and likely threat-scenarios - assuming correct configuration of TLS certificates etc. In ...


7

If you have no liability for what the users do with the laptop, then what is the benefit to you of monitoring the usage. In the absence of any legitimate benefit, that would leave anyone questioning your motives in doing so - so you would create liability by doing this. There are a lot of other security concerns you should be concerned about - primarily ...


7

Basically it is not safe. As far as I know, they use 512-bit RSA because they mimic what Microsoft's RDP server used to do, which indeed implied a 512-bit RSA key; using something bigger would risk breaking compatibility with existing clients. Biggest issue, though, is not that the 512-bit key is weak because too short; the main problem is that, as a client, ...


7

NoMachine is more-or-less X11 over SSH with improvements in performance. So the two benefits there are that SSH is managed for you and that you don't have the ghastly performance of X11 over a network. (ISTR that SSH is not the default, but it's essentially a dropdown option, not a setup saga). VNC also provides better performance than X11, and can be ...


7

Yes it's possible. An obvious example would be a Remote Access Trojan (RAT). Once your computer is infected they can do essentially whatever they're set up to do. This includes monitoring your screen, logging keystrokes, and accessing webcams. My personal experience with this was being infected with the Blackshades RAT a few years ago. I was monitored for ...


Only top voted, non community-wiki answers of a minimum length are eligible