TeamViewer

I'm gonna pop a banner that just says, "Brought to you by Fable 5.1.

If you'd like to do, you know, use this product, get on a fucking boat and get out of China," right? Like, there's a lot of things, right, that, that you can do because it's basically somebody giving you a TeamViewer console and saying, "Hey, remotely control my computer." Also, uh, the, the person routing this request is doing something fraudulent along the way.

Their reputation is entirely, uh, yours to control.

So there's a, you know, I think the question is, you know, how, how dirty are we willing to fight? And frankly, this is where I hope the San Francisco cadre lets go of a little bit of control and lets some of the DC folks get a little more involved.

It's the unattended remote help for physical Windows device.

And we discussed about different options like in-desk, TeamViewer, et cetera.

And I didn't really like the remote help because you need the user to be here.

It's not really emergency friendly.

This would be ...

This would leave zero ambiguity around the potential for a company to just [snaps fingers] pretty much on a whim say, "Hey, not yours anymore." Speaking of, uh, companies that on a whim decided you didn't own things anymore, remember how I went off on TeamViewer, uh, kicking me off of my TeamViewer 12 perpetual license? So they removed anywhere to download it from their website officially, if I recall correctly, or it's like really, really hard to find now.

It still works.

I went to use it the other day and I was like, oh, my TeamViewer 12.

It's-

In spite of what they said, actually still works

Remote management solutions, not good.

If you can, I would say it's very likely, I'm just coming up with this in the moment, but it's very likely that enterprise grade remote management solutions like AnyDesk and TeamViewer and TeamSupport and all that stuff, because they are legitimate RMM solutions and they're just being weaponized by threat actors, the IP address schemes are probably well known, established for the business.

So you could either passively detect um traffic going to those ip address ranges and then notify or you could block access to those ip address ranges uh for sure so like those are some options um they are installing malware what's the point of the malware that would be the next

question i have um I mean, the threat actors get

The goal, of course, here is that Faronics is a normal, valid software, and as such, often not detected by endpoint protection.

It does not match any like malware signatures per se, but it's definitely software that you must keep an eye on, similar to screen sharing software like TeamViewer and such, which is legitimate software but often abused.

Definitely make sure that nothing like this all of a sudden gets installed on your systems, and Huntress does provide some indicators of compromise here that you can use to check.

Well, and that's it for today.

It's like... three exclamation points i found the email which is like okay and he goes i'm not going to show you dixie carter's address okay uh and i'm just going to summarize this so he he puts in the book the email that he sent dixie after the fact after being accused of like not seeing the sent email And he says, I called my IT guy from pyroandballyhoo.com, which is Chris Chisholm, Mr. X.

And he reminded me that there's a free download called Team Viewer.

I

mean, if Dixie's like me, she stops reading it right there.

Once you are hooked up to the internet, then we're good to go.

EasyReader comes with a built-in remote control software called TeamViewer.

When you turn EasyReader on, there's a row of icons that appear across the bottom of the screen.

And one of those icons is the letter T.

And when you press the T, that will start the TeamViewer program and the user doesn't have to make any other inputs.

There's no code they have to enter.

There's no thank you, yes or no, approve.

There is.