6

Recently someone using a computer of mine started a remote session with GoToMeeting and allowed someone to control the PC. UAC didn't block the session (they're a regular user). It appears that many of the remote access tools ignore UAC and regular users can invite anyone to control the PC.

Are there any methods of blocking tools like GoToMeeting, join.me or TeamViewer on a regular Windows 7 PC?

So far the only thing that seems feasible is blocking the websites serving up these tools, but there are easy ways around that.

Many of these tools seem to dynamically use ports that are open, so port blocking doesn't seem feasible either, but I might be wrong.

10
  • 1
    What extreme steps are you willing to go? You can prevent the programs from being installed but won't prevent the portable applications. A combination of blocking those domains at the firewall level and prevent users from installing applications is your best bet.
    – Ramhound
    May 7, 2014 at 18:25
  • @Ramhound Yeah, a firewall solution is the best bet. It's hard to tell what domains to block though, I would assume some of those tools have backup domains or even directly connect to an IP to get routed.
    – user201262
    May 7, 2014 at 18:28
  • 8
    Unless you installed the remote software through a UAC prompt the remotely connected computer would have had the same privlages as the user to started the session. So it does not "ignore UAC" but because the person remotely connecting can is not performing any actions that require a UAC prompt no UAC prompt shows up. If they attempted to do anything that would require a UAC prompt then the prompt would still show up and they would need an administrator's account credentials. May 7, 2014 at 18:39
  • I understand your question, but what is your concern? Do you think a user will be tricked into giving remote control to someone malicious? If so, IMO the best course of action is to educate the user(s) and deal with related incidents circumstancially. Furthermore, you could set up a system where a remote user can verify their identity to the user.
    – Wutnaut
    May 7, 2014 at 20:50
  • @wutnaut I agree, the first line of security is the person between the chair and keyboard. To be honest, I'm not just worried that they'll be tricked into giving access to someone malicious, that is actually what happened.
    – user201262
    May 7, 2014 at 20:58

1 Answer 1

9
+50

All of these services rely on connecting to the service provider (e.g. GoToMeeting) before the other party can connect to you. As such, you should be fairly successful by simply blocking their domains on your router. Even inexpensive home routers support this feature.

As an example, take a look at the "Website Filter" page on a $20 D-Link router. In each of the boxes you would enter domains such as gotomeeting.com, joingotomeeting.com, join.me, etc.

If I find a pre-compiled list of these, I will make sure to update this post.

You must log in to answer this question.