As seen in the news (June 2016):
There have been hacking activities through TeamViewer.
Currently it seems this was mainly because of careless end users.
- I have an account at LinkedIn with username "email@example.com" and password "Banana53"
- And I use the same username and password at TeamViewer
- Now by some leak, hackers get access to cleartext contents of my LinkedIn account
- So they try to use the same username and password for different services - refer https://haveibeenpwned.com/
In response the TeamViewer corporation:
- Strongly recommends to use different credentials for different services
- Strongly recommends to change your passwords frequently
- Strongly recommends to enable Two-Factor Authentication
- Is currently introducing Trusted Devices and Data Integrity
So far, so good.
But I'm having difficulties in understanding the exact security configuration of TeamViewer.
For family and friends I'm doing a lot of "remote administration" (unattended access) and "remote support".
so on the target machines I have installed either TeamViewer Host 10.x or the full version - and linked it to my TeamViewer account.
I have set a "personal password (for unattended access)".
and I have not enabled the checkbox to grant my account "easy access".
screenshot from TeamViewer Host 10.0.47484:
- On my local machine I open TeamViewer and log into my account.
- When establishing a connection to any of my remote machines I never get asked to enter any password.
So whenever somebody hacks into my TV account (due to whatever reasons), the hacker will automatically get access to all machines that are linked to my TV account.
The "password" feature seems to be broken?
How do you make sure that it's mandatory to enter some TeamViewer password as configured for the remote machine?