Feeds

Remote IT support tool hijacks customer webserver

TeamViewer turns outage into ad time

  • alert
  • submit to reddit

Internet Security Threat Report 2014

On Thursday morning, IT consultant Paul Nash received an urgent call from a client whose Apache webserver had crashed the previous night and inexplicably wouldn't restart. Equally vexing, people who tried to visit the client's website during the 10-hour outage received a message advertising TeamViewer, a maker of widely used software for remotely managing PCs and servers.

After 90 minutes of troubleshooting, Nash traced the problem to TeamViewer, which he used to remotely administer the client's servers. It turns out the program had opened up its own webserver on the client's machine as soon as Apache went down and in the process made it impossible for the client, a large provider of business software, to restart its proper website.

"At that point, basically the webserver is hosed because if Apache tries to start up again, it sees someone else on port 80 and it falls over and dies, which is kind of antisocial behavior," Nash, who is the principal at Toronto-based Nash Networks, told The Register. Nash was able to get Apache up and running again by killing TeamViewer processes on the server, but by then, the client "had quite a bit of irate support requests stacked up."

The incident highlights a serious liability that comes from using what he otherwise regards as a great tool for remotely managing the thousands of PCs and servers entrusted to him. But what really sticks in Nash's craw, he said, is the blase attitude TeamViewer support people showed when he reported the SNAFU.

"They said they don't see what the problem is," he said.

After he escalated the complaint, Nash finally received instructions for modifying the registry of machines running TeamViewer so its webserver won't automatically start should the normal webserver go down. But this requires him to put his hands on every machine he manages, a solution that's needlessly cumbersome.

Also concerning, said Nash, is TeamViewer's lack of disclosure that its software is receiving incoming traffic sent to machines that run the software.

"They're sitting in the middle and they're in a position to snoop on all my traffic," he said, adding that he thinks that scenario is unlikely. Still, when Nash learned that TeamViewer does monitor for incoming web requests, he said it made him wonder: "What else aren't they telling us?"

TeamViewer's website claims the software has more than 15 million installations in 50 countries. Company representatives didn't immediately respond to requests for comment sent early Friday evening Germany time. We'll be sure to update this article, if they get back to us. ®

Update

A TeamViewer representative emailed us the following:

Yes TeamViewer tries to use port 80 if available first. TeamViewer also waits about 10 Minutes for an eventually available Webserver to start. If this doesn't happen because there is no Webserver or because the Webserver crashes TeamViewer grabs port 80.

If you should start the Webserver afterwards TeamViewer still uses port 80 so the Webserver can't work on it. If you then close TeamViewer or restart the PC you can reallocate port 80 again.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.