6

I’ve been tasked with helping the security department close up a few holes. They are in the process of hiring a dedicated network guy, but for the time being, I’m the closest they have. They’ve already closed off Skype and IM, and they just heard about TeamViewer and are concerned about people getting in and accessing our PCs via that route.

Obviously we’re safe as long as nobody in the office is using it, but that rule has no teeth if it can't be detected. Where should we be looking, and what should we look for to know if someone has it installed, or (since you can use it without installing as well) is currently using or has used it in the past? Does this sort of thing show up in web request logs, since TV uses port 80?

3 Answers 3

6

The TeamViewer website states that TCP port 5938 might be used, and that port seems to be open on my local machine when TeamViewer is running.

Trying running a port scan looking for machines that are open on port 5938.

I've also noticed that the built-in web server in TeamViewer replies "This site is running TeamViewer.", so do a port scan on port 80 as well and check the results. Nmap is a nice tool for port scanning.

3
  • Also if you have a web proxy, block user agent DynGate, URL teamviewer.com and any url containing the string 'dyngate'.
    – resmon6
    Feb 9, 2012 at 14:11
  • So, I'd have to be looking at the exact moment someone is using it? Is there some way to keep tabs on what's happening while I'm out of the office or in a meeting or something? Feb 9, 2012 at 23:56
  • Yes, you'd probably have to script a check that is repeated every hour or so. It's probably pretty easy to script a check that sends an email if any open ports are found, especially in bash on a Linux box. You'd have to create a script running on the firewall/router to detect active connections.
    – Janek
    Feb 13, 2012 at 10:04
2

Try command:

avahi-browse -t -r _teamviewer._tcp

You'll get a list of IP addresses:

eth0 IPv4 850808873        _teamviewer._tcp     local
hostname = [xxxxxx.local]
address = [172.16.0.81]
port = [2020]
txt = ["UUID=bd5064d1-5ec8-496c-93cd-c273ec37faa7" "Token=nHLKXaM19dWptBDw" "DyngateID=850808873"]
0

I’m afraid you are approaching this backwards - blocking specific things is like running just to stand still. Instead block everything by default and allow only specific things once they have been validated as both necessary and safe. This is called “whitelisting”.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .