TeamViewer Hacks Make Virtual Possession a Thing

Stored in the drives of our personal laptops and phones is the entirety of the information that makes us all complete people on the internet. If someone gets a hold of our email password, they have access to a fraction of our personal information. If someone could get into our computer, they’d have access to the whole pie. This is the problem facing the victims of the TeamViewer hack.

TeamViewer is a free-for-personal, pay-for-commercial program that gives users the ability to log on and control computers remotely. If grandpa needs help with his Windows 10 update, it takes just a couple of clicks to control it from thousands of miles away. The simplicity of the program makes it useful and convenient, it also makes it particularly vulnerable to security breaches.

In a recent interview with ArsTechnica, a TeamViewer spokesman, Axel Schmidt put the seriousness of the recent breaches in perspective, “What TeamViewer does and what it’s designed to do is establish a connection from one device to another and to control that device and that would pretty much put the user who takes control in a position to do virtually anything.” A person using TeamViewer to access a system remotely becomes, in essence, the same as the primary user of the system accessed, and this affords them the same access.

“In the middle of my gaming session, I lose control of my mouse and the TeamViewer window pops up in the bottom right corner of my screen,” says Nick Bradley, an IBM researcher, in his first-hand account of a TeamViewer hacking attempt.

A Reddit thread about these hacks describe that the most frequent violations are internet purchases through a victim’s Amazon and eBay accounts, or draining money out of a victim’s PayPal account. The same thread detailed the hard time victims are dealing with trying to prove fraud. Since these websites were accessed from the victim’s computer, and therefore the appropriate user IP addresses — the online version of a home address — there is no easy way to prove that the victim didn’t initiate the transactions themselves. There is no way to justify reversing the transactions.

In the same ArsTechnica interview, Schmidt said far worse is possible, if you grant somebody access to your device they can install malware if they mean ill or install a key-logger and that way they can pretty much “get their hands on everything.” As a result, many Reddit users mention a full system wipe as part of their counter-measures.

TeamViewer has held the position that the breaches result from poor user password management, not a vulnerability in their system. That said, the company has released new tools like access logs and two-step identity verification to combat some of these issues.

The easiest way to avoid becoming a victim is to uninstall the program or at least turn it off. For those looking to remain active and frequent TeamViewer users, there’s a great How-To Geek article on utilizing the available new features to secure your account. Thankfully, preparedness is more valuable than faith in warding off possession of the virtual kind.