How PAM Could Have Mitigated the TeamViewer Attack

You’ve seen it in the headlines: TeamViewer, infiltrated by Russian hackers. In this blog, we break down the attack: the timeline, how the malware was deployed, and the wider system compromised. We then look at Privileged Access Management (PAM) as a tool for preventing the infiltration and spread of such malware attacks, and investigate more secure alternatives to TeamViewer.

The Attack on TeamViewer

Timeline and Initial Attack

The attack commenced with cybercriminals exploiting vulnerabilities in TeamViewer, a popular remote access tool, to gain unauthorized access to systems. This was identified by cybersecurity researchers at Huntress, who noted that this type of exploitation has been a recurring issue with TeamViewer, given its widespread use and the critical access it offers to systems.

Malware Deployment

Once access was established, the attackers deployed a ransomware known as LockBit, which encrypts the victim’s files and demands a ransom for decryption. Interestingly, the ransomware payload bore similarities to LockBit ransomware encryptors, suggesting a sophisticated level of adaptation and deployment by the attackers.

System Manipulation

Post-infiltration, the attackers utilized their access to execute further malicious activities. This included the deployment of a DOS batch file named “PP.bat” from the user’s desktop, which subsequently ran a malicious DLL, showcasing an advanced understanding of native system processes to maintain persistence and evade detection.

Implications

This attack not only highlights vulnerabilities in remote access tools like TeamViewer but also illustrates how attackers can leverage such tools for large-scale ransomware deployments. It serves as a critical reminder of the potential for “shadow IT” installations where software is not directly managed by an organization’s IT department, increasing the risk vector.

Using PAM to Prevent & Detect

Privileged Access Management (PAM) solutions could potentially prevent or mitigate the impact of cyber attacks like the one experienced by TeamViewer through several strategic measures:

• Segmentation of Access: PAM solutions segment access to critical resources, ensuring that even if attackers breach one area, they cannot easily access other sensitive parts of the network. This compartmentalization significantly limits the scope and damage of an attack.
• Least Privilege Enforcement: By enforcing the principle of least privilege, PAM solutions ensure that users and systems have only the necessary access rights to perform their tasks. This minimizes the potential damage from malware by restricting the permissions it can acquire.
• Multi-Factor Authentication (MFA): PAM solutions often enforce MFA for accessing sensitive systems, providing an additional layer of security that can deter attackers, even if they have compromised credentials.
• Real-Time Monitoring and Alerts: Continuous monitoring of user activities and the use of analytics to detect unusual behavior are key features of PAM solutions. These tools can alert administrators to potential security threats early on, allowing for a rapid response before issues escalate.
• Endpoint Security: Managing and monitoring endpoints to ensure they are up-to-date with security patches and free from signs of malicious activity is another critical function of PAM solutions. This reduces the risk of attackers exploiting known vulnerabilities.
• Comprehensive Audit Trails: PAM solutions maintain detailed logs of user actions and system changes. These logs are crucial for quickly understanding the nature of a breach, what was affected, and how to contain it. They also aid in forensic investigations and help prevent future breaches.

Collectively, these features not only mitigate the impact after a breach occurs but also strengthen an organization’s overall security posture to prevent initial compromises. Implementing robust PAM measures is essential for companies to protect themselves against sophisticated cyber threats.

Alternative to TeamViewer: Admin By Request

Admin By Request is a Privileged Access Management (PAM) solution which ticks all the boxes for preventing and mitigating cyber attacks. Alongside its robust PAM functionalities, Admin By Request also offers secure, browser-based remote access capabilities. This feature serves as a more secure alternative to TeamViewer, offering enhanced safety protocols for remote operations. Read more about the solution below.

1. Zero Trust Architecture: Admin By Request’s Remote Access operates on a Zero Trust security model, which assumes no user or device is trusted by default, irrespective of their location relative to the network perimeter. This contrasts with traditional tools like TeamViewer, where authenticated devices can sometimes have broad network access. This approach minimizes the risk of unauthorized access.
2. No Installation Required: Unlike TeamViewer, which requires software installation that could potentially be exploited as a vector for malware, Admin By Request’s solution is browser-based. This minimizes the attack surface by eliminating the need to install or maintain additional client software on devices.
3. Enhanced Oversight and Control: Admin By Request provides robust monitoring and logging of all remote access sessions. This ensures that all activities are recorded, and anomalous behaviors can be detected in real-time, providing an additional layer of security and compliance that may not be as stringent in traditional remote access tools.
4. Segregation of Duties: The platform supports strong segregation of duties, ensuring that users have access only to the resources necessary for their roles. This limits potential damage in case of account compromises, which can be a concern with tools that provide broader access once credentials are authenticated.
5. Comprehensive Access Policies: Admin By Request remote access features allow organizations to implement detailed access policies, tailoring access rights based on user roles, time, and session context. This level of control helps prevent misuse and unauthorized access, a challenge often faced by users of more generic remote access tools.
6. Regular Security Updates and Patches: Being a cloud-based service, Admin By Request’s Remote Access benefits from regular updates and security patches managed by the service provider, ensuring protection against the latest vulnerabilities and threats without the end-user intervention required by desktop-based solutions like TeamViewer.

The recent cyber attack on TeamViewer was a wake-up call: being casual about cybersecurity doesn’t cut it anymore. This attack highlighted how hackers exploit well-trodden paths, and it’s clear organization’s need to layer up digital defenses, fast.

Implementing Privileged Access Management (PAM) is a good start. Locking down access controls and keeping an eagle eye on system activities enables both prevention and early detection & mitigation of malicious activities. And let’s not forget about finding safer alternatives to tools like TeamViewer – upgrading to more secure solutions like Admin By Request means staying a step ahead of cybercriminals. Book a demo today to start layering up your organization’s security.