https://www.reddit.com/r/teamviewer/comments/4m6omd/teamviewer_breach_masterthread_please_post_your/

Teamviewer Breach Masterthread - Please post your details and if you were a victim or not : teamviewer

I feel as though this thread is really needed so we can try and find a pattern to what is going on here. If you could use the format below it will make it easier to read:

• Were you hacked:

• Date of hack:

• TV Version:

• Do you have a TV Account:

• Is you TV Account email address listed as pwned:

• Was 2FA enabled:

• Is your TV Account Password the same as any other password:

• Additional Notes:

This was much more widespread than what I was expecting.

Now it is stickied I feel as though I should answer some FAQ (this my first time doing anything like this so sorry for any mistakes!)

Has Team viewer been hacked? The official response is no. Team Viewer is putting the blame, very publicly, on users having weak / compromised passwords from other site breaches. This may well be the case, but there have been plenty of reports now that users with very secure, randomly generated and unique passwords have also had their computers compromised.

The DNS outage that TV had, was this anything to do with what we are seeing now. Official response is no, it was caused by a DDOS attack. Many people are questioning this official response though as unconfirmed reports suggest that the DNS records were linking to China at one point.

Does 2FA and Whitelisting accounts keep me secure? We have no idea, we don't know how these attacks are happening. It can't hurt to turn them on though.

What are the attackers after? It looks like they are stealing login credentials for popular online shops and then going to town with these saved credentials. Popular ones seem to be Amazon, PayPal, eBay. There have also been reports of them installing malware.

How do I know I have been compromised? If you are sat at your machine, you will see someone take over it, of this happens, disconnect them and remove any internet access. If you are unsure what to do, unplug your router. That will stop them in their tracks. Other signs are checking your browser history for sites you haven't been on, checking your emails for any new purchases (they have started to delete these emails), checking your PayPal accounts, checking your card statements and check the log files of TV.

I have been compromised, what do I do?

Using another computer than is clean, reset all of your passwords. Password managers are highly recommended. Just don't leave them logged in. It is advised to do a full wipe of you computer as you have no idea what they may have hidden.

How can I stay safe? Best way at the moment in time till it is confirmed what method is being used to attack TV users is to stop TV from running completely, or uninstall it for the time being. If you still feel scared, cuddle a blanket or a soft toy!

Important information about the log files from /u/thingfour

LINUX USERS special note: GRAB YOUR LOG FILES BEFORE YOU UNINSTALL TEAMVIEWER

It seems you must have TeamViewer installed in order to view the TV log files. Apparently the Linux version does not just automatically create separate log files continuously and save them somewhere. On the Windows machines I uninstalled TV from, the log files remained, as they should be. For whatever reason, they decided not to do it that way w/Linux.

Why do you want the logs? To look and see if there have been any mysterious remote connections, etc.

From their site:

Linux

The relevant information and logfiles are stored within a ZIP file. The file can be created via command line.

If asked for log files, run the following command (with root) on a command line: teamviewer –ziplog Please send us the ZIP files.

/u/Lord_Greywether has kindly put the results into a GoogleDocs file for easy reading.

https://docs.google.com/spreadsheets/d/1Cmxz2VHMKsi96WZ3enTGuXShmXcW8Vg5sYFaXK8kmxg/edit?usp=sharing

DISCLAIMER: I have no inside knowledge. I have just kept track and combining what others are saying. What has been posted is just advice and rumours. It is up to you to make your own decision on what you think is happening / what to do.

^ed