I’ve been tasked with helping the security department close up a few holes. They are in the process of hiring a dedicated network guy, but for the time being, I’m the closest they have. They’ve already closed off Skype and IM, and they just heard about TeamViewer and are concerned about people getting in and accessing our PCs via that route.

Obviously we’re safe as long as nobody in the office is using it, but that rule has no teeth if it can't be detected. Where should we be looking, and what should we look for to know if someone has it installed, or (since you can use it without installing as well) is currently using or has used it in the past? Does this sort of thing show up in web request logs, since TV uses port 80?

up vote 5 down vote accepted

The TeamViewer website states that TCP port 5938 might be used, and that port seems to be open on my local machine when TeamViewer is running.

Trying running a port scan looking for machines that are open on port 5938.

I've also noticed that the built-in web server in TeamViewer replies "This site is running TeamViewer.", so do a port scan on port 80 as well and check the results. Nmap is a nice tool for port scanning.

  • Also if you have a web proxy, block user agent DynGate, URL teamviewer.com and any url containing the string 'dyngate'. – resmon6 Feb 9 '12 at 14:11
  • So, I'd have to be looking at the exact moment someone is using it? Is there some way to keep tabs on what's happening while I'm out of the office or in a meeting or something? – StormShadow Feb 9 '12 at 23:56
  • Yes, you'd probably have to script a check that is repeated every hour or so. It's probably pretty easy to script a check that sends an email if any open ports are found, especially in bash on a Linux box. You'd have to create a script running on the firewall/router to detect active connections. – Janek Feb 13 '12 at 10:04

Try command:

avahi-browse -t -r _teamviewer._tcp

You'll get a list of IP addresses:

eth0 IPv4 850808873        _teamviewer._tcp     local
hostname = [xxxxxx.local]
address = [172.16.0.81]
port = [2020]
txt = ["UUID=bd5064d1-5ec8-496c-93cd-c273ec37faa7" "Token=nHLKXaM19dWptBDw" "DyngateID=850808873"]

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.