Pivity

Teamviewer breached, malware gets ALL of your passwords

Last read Never
#1

I know this isn't related to scripts, coding, etc at all but I'm sure many users here have teamviewer installed.

TeamViewer was recently compromised by a third party, and malware was implemented that retrieves saved emails, usernames, and passwords from your browser. To make sure you're safe, follow these steps: Find the TeamViewer logs here: C:\Program Files (x86)\TeamViewer\TeamViewer11_Logfile.txt C:\Program Files (x86)\TeamViewer\TeamViewer11_Logfile_OLD.txt Do a search for "webbrowserpassview.exe". If it's in your logs, you should change your passwords immediately. This software essentially shows and exports all your saved username and passwords from your browsers (chrome, IE, firefox, etc). Partial log entry showing the offending text: http://pastebin.com/cAYCLjjp Screenshot of WebbrowserPassView program: http://imgur.com/YKIoVsL

Friendly x 1
#2

lmao that's the same process from the April 2014 attack on gmod that stuck porn to your gmod no matter if you uninstalled or not :v

#3

Yeah, I heard about this breach a few days ago, pretty interesting but luckily for myself I don't run TeamViewer 24/7 to even care.. lol

#4

Any idea if this only effected teamviewer 11?

I never updated from 10, so I hope not...

edit:

Just remembered I don't save my passwords in my browser so I'm safe.

Thanks for the heads up by the way.

#5
Byroastchickenat 3rd of June 2016 06:29:26
Any idea if this only effected teamviewer 11?I never updated from 10, so I hope not...edit:Just remembered I don't save my passwords in my browser so I'm safe.Thanks for the heads up by the way.

It affects all TeamViewer versions, as TeamViewer has been breached in a whole. Also, if the malware was installed on your PC, then it can Keylog any action you do and not just steal your logins you have stored in your browser.

#6
ByDaddyat 3rd of June 2016 07:07:37
It affects all TeamViewer versions, as TeamViewer has been breached in a whole.Also, if the malware was installed on your PC, then it can Keylog any action you do and not just steal your logins you have stored in your browser.

Well they would have to push a new update that included the malware, and I'm not sure how they would do that for an old version.

#7

lmao I uninstalled TeamViewer a couple months ago on my actual PC. Thing was absolute shit and annoying I just taught the client how to use permission files inside their FTP.

Funny x 1
#8
Byroastchickenat 3rd of June 2016 10:08:19
Well they would have to push a new update that included the malware, and I'm not sure how they would do that for an old version.

You must be unaware, they aren't pushing updates or anything like you might think to target users, they have everyone's ID and Password to connect to their PC and target the user with Ransomware/Malware. Oh and right, with the older versions of TeamViewer you still get the option on the top right of the program to update to the latest version or not.

#9
ByDaddyat 3rd of June 2016 21:26:15
You must be unaware, they aren't pushing updates or anything like you might think to target users, they have everyone's ID and Password to connect to their PC and target the user with Ransomware/Malware.Oh and right, with the older versions of TeamViewer you still get the option on the top right of the program to update to the latest version or not.

yeah, but the browser password cache stealer would require an update to be pushed

Dumb x 1
#10
Byroastchickenat 4th of June 2016 06:44:11
yeah, but the browser password cache stealer would require an update to be pushed

No, not at all, you are still missing the point. test

The "Hackers" have access to everyone's Unique ID and Passwords and then going onto the users PC's at night and installing the malware. That's why only some may have "webbrowserpassview.exe" in their logs while some may not. Now it would be very smart if they had access to push out such an update but unfortunately it looks like they don't since they connecting to the PC's vs pushing out such an update.

Agree x 1
#11
ByDaddyat 4th of June 2016 21:40:23
No, not at all, you are still missing the point.testThe "Hackers" have access to everyone's Unique ID and Passwords and then going onto the users PC's at night and installing the malware. That's why only some may have "webbrowserpassview.exe" in their logs while some may not. Now it would be very smart if they had access to push out such an update but unfortunately it looks like they don't since they connecting to the PC's vs pushing out such an update.

Wow, I had no idea they would use such a roundabout way of stealing passwords. But I guess it makes more sense they only breached passwords rather than their entire system.

Agree x 1
#12

Glad i only used the run one so it doesnt download teamviewer to my pc peww.

Users viewing this thread
Nobody