Table of Contents
TeamViewer, a popular remote access and control software provider, has publicly disclosed irregularities within its internal corporate IT environment, discovered on Wednesday, June 26, 2024.
TeamViewer has disclosed this issue in their Trust Center, stating, “We immediately activated our response team and procedures, started investigations together with a team of globally renowned cyber security experts and implemented necessary remediation measures.”
“TeamViewer’s internal corporate IT environment is completely independent from the product environment. There is no evidence to suggest that the product environment or customer data is affected. Investigations are ongoing and our primary focus remains to ensure the integrity of our systems.”
Despite this, TeamViewer’s ubiquitous use in both consumer and corporate environments, and the fact that it is a remote access tool, makes any potential breach a significant concern.
Separately, today, the Health Information Sharing and Analysis Centre issued a bulletin alerting the health sector to active cyber threats exploiting TeamViewer.
How to Mitigate Potential Risks from TeamViewer with ThreatLocker®
While this situation is ongoing, ThreatLocker® recommends that customers review their policies for any related to TeamViewer and disable or remove any that are not necessary.
A Global or Entire Organization Deny policy for TeamViewer can also be created, which will supersede any computer or Group permit policies.
If use of TeamViewer is necessary during TeamViewer’s investigation, TeamViewer can be permitted using scheduled policies, to prevent its use outside of normal business hours.
A Remote Access Tool such as TeamViewer typically does not need full file system access. If TeamViewer is to run in an environment, it should be ringfenced from accessing the file system.
ThreatLocker® Detect should be implemented to alert on and respond to indicators of attempted compromise. In addition, the ThreatLocker® Cyber Hero® response team is on standby 24/7/365 to take action in case you cannot.
