TeamViewer Hacked? It Certainly Looks Like It

The New Acunetix V12 Engine

So is TeamViewer Hacked? There’s no definitive answer for now as they aren’t admitting to anything – but it does look very suspicious. The whole service was down for a few hours, the domains were apparently pointing to Chinese IP addresses (DNS Hijacking?) and no-one could login.

TeamViewer Hacked? It Certainly Looks Like It

A whole bunch of users also turned up claiming their computers were hacked via TeamViewer with funds being stolen from PayPal bank accounts and all kinds of havoc being wreaked.

It’s not really looking good for TeamViewer right now, and whilst they are stating their DNS servers got DDoSed – which took them offline, they really aren’t saying anything more than that.

TeamViewer users say their computers were hijacked and bank accounts emptied all while the software company’s systems mysteriously fell offline. TeamViewer denies it has been hacked.

In the past 24 hours, we’ve seen a spike in complaints from people who say their PCs, Macs and servers were taken over via the widely used remote-control tool on their machines. Even users with strong passwords and two-factor authentication enabled on their TeamViewer accounts say they were hit.

It appears miscreants gained control of victims’ TeamViewer web accounts, and used those to connect into computers, where they seized web browsers to empty PayPal accounts, access webmail, and order stuff from Amazon and eBay.

“Hackers got everything from me,” Doug, an Idaho-based Twitch streamer who was looking forward to celebrating his birthday today with his wife and two kids, told The Register.

“They remote connected in at 5AM MT, went into my Chrome and used my PayPal to buy about $3k worth of gift cards. And yes, I had two-factor authentication.”

Over on Reddit, people were lining up with tales of their systems being compromised via TeamViewer, sparking fears the platform had been hacked. TeamViewer makes remote-control clients for Windows, OS X, Linux, Chrome OS, iOS and Android.

TeamViewer Hacked

It seems like the TeamViewer hacked talk came from the web service, which would be consistent with the platform being compromised – as the users with strong authentication details also suffered losses (strong passwords and 2FA alike).

TeamViewer is totally denying any kind of intrusion point blank and has stated multiple times there has been no breach, Teamviwer hacking is not an uncommon thing though.

Pouring further fuel on the fire that TeamViewer had been infiltrated by criminals, at about 0700 Pacific Time (1500 in the UK) today TeamViewer suffered an outage lasting at least three hours, which knocked its website offline and left people unable to connect to their computers remotely.

It’s claimed’s DNS was screwed up during the IT snafu, thus stopping people from getting through to the Germany-based company’s servers. We’ve heard that its DNS servers were pointing towards Chinese IP addresses at one point, but we haven’t been able to verify that.

After getting its systems back online, TeamViewer insisted that its security was not breached. In a statement bizarrely dated last week but referencing today’s events, the biz instead blamed “careless use” of passwords by its customers. People aren’t using strong enough credentials, or are reusing passwords from websites that have been hacked – such as LinkedIn and Tumblr, we’re told.

“Users are still using the same password across multiple user accounts with various suppliers. While many suppliers have proper security means in place, others are vulnerable,” the company said.

We will have to see over the next few days if TeamViewer suddenly has a change of heart and becomes a little more forthcoming about the details of an intrusion (if indeed there was one).

As usual, they are fingering users, with some vague statement about weak passwords or reused passwords from other breaches. You can check out more Hacking News here.

Source: The Register

Posted in: Hacking News

Latest Posts:

DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.

7 Responses to TeamViewer Hacked? It Certainly Looks Like It

  1. Kek June 3, 2016 at 7:11 am #

    Hah, you said they were fingering users.

    • Darknet June 3, 2016 at 3:56 pm #

      Glad to see that tickled you ;)

  2. Hakan June 3, 2016 at 7:43 pm #

    Alpemix is much more better

  3. AndyAdmin June 3, 2016 at 9:42 pm #

    These two statements contradict each other:

    “Even users with strong passwords and two-factor authentication enabled on their TeamViewer accounts say they were hit.


    It appears miscreants gained control of victims’ TeamViewer web accounts…”


    2-factor authentication would prevent login to TV web accounts (unless there was indeed a breach).

    • Darknet June 3, 2016 at 10:24 pm #

      Exactly why I’m saying it looks like a breach..

  4. Crates June 3, 2016 at 10:22 pm #

    DNSSEC and DDoS-protected NS servers (e.g. CloudFlare) exist for a reason.

    Shame on TV for not getting ahead of this, and shame for not owning up.


  5. Mike June 6, 2016 at 2:43 pm #

    Regarding Doug from Idaho who’s quoted in the article – OK, so somebody managed to remote control into your computer. But then how did they get into your Paypal account so easily?

    Did you re-use the same password?

    Or do you have the Paypal site set to remember your computer so that you don’t have to type in your Paypal password?

    Sorry Doug, perhaps it’s not your fault that the bad guys connected to your computer via TeamViewer, but you certainly were lax in your security practices regarding your Paypal account.