Remote access software (a.k.a. remote control software) are very useful tools that serve in different occasion, from enabling your support vendor who is located 3000 miles away troubleshoot a server or network incident, to remotely performing administration function on servers running in your Hong Kong data center from your London office. Remote access software is a valuable tool for the mobile workforce. It can especially be useful for small businesses that may not have staff onsite to perform certain tasks or big businesses who wish to cut down on their support cost. They can be unavoidably required in situations where a client organization’s technical support vendor is thousands of miles away (say in New York) and an issue requires the vendor staff to access a server or device within an organization’s network that is located in Lagos for just 30 minutes to fix a matter. It really won’t make sense to fly the vendor staff down to Lagos from New York to fix an issue that can be resolved in 30 minutes. Remote access tools could be used in such situations, which would save a whole lot of cost and logistics.
Generally, to remotely access a computer, it is required that some sort of software is installed on the computer you wish to connect to, known as the host. Once that is done, a connection can be made from another computer or device with the right credentials, known as the client to control the host. There are several remote access software in the market, which are not limited to Teamviewer, Dameware Mini Remote Control, Remote Utilities, UltraVNC, AeroAdmin, RemotePC, etc. Teamviewer is the most popular among all of them and present the best and broader features. With support for remote control, video, voice calls, and text chat, TeamViewer also allows file transfers, supports wake-on-LAN (WOL), and can even remotely reboot a PC into Safe Mode and then reconnect automatically. Teamviewer comes in installable version, portable version called TeamViewer QuickSupport (for one off remote control or if administrative right or installing software on the host PC isn’t possible) and lastly, the TeamViewer Host if regular usage of the software is required. Remember, no changes to router or firewall configurations are needed.
Despite the convenience and cost saving being brought to bear with these tools and as vital as remote access software has become, it also presents serious security risks to the organization if its use is abused. If there are any vulnerabilities in the software, a simple breach somewhere in the system can give a hacker free entrance into a network and all of its data. The most disreputable of all security incidents involved a retail giant, Target (a US Company) where hackers gained access through a remote access software used by a third-party vendor and breached payment card data of its customers. Beyond software vulnerabilities, the most worrisome are incidents of abuse from users and administrators alike.
As the Chief Information Security Officer (CISO), Chief Compliance Officer (CCO), Chief Audit Executive (CAE) or persons that have responsibility for information security in an organization, do you know who are connecting to your network via remote access tools like Teamviewer and for what purpose? Do you have data on the number of users and administrators that made use of these remote access tools in the past one year and the purpose? Are authorizations required before such tools are used on the network? How sure are you that disloyal or disgruntled employees and even the ignorant ones are not opening backdoors or poking holes on your network unknown to you? Have you scoped some of the potentially unwanted programs (PUPs) like remote access tools in your enterprise security monitoring? A lot of questions begging for answers.
Organizations that do not restrict the use of remote access tools stand the risk of their network being breached by fraudulent vendor staff, disgruntled employees as well as syndicate of fraudsters targeting the organization. By not uninstalling/deleting a remote access tool previously used for an authorized support, a vendor staff could reuse the tool to subsequently connect back to the organization’s network without authorization. Disgruntled and fraudulent employee in collaboration with external elements could cause damage not limited to denial of service, financial loss or reputational damage to an organization. By installing or copying the remote access tool into PCs within the organization’s domain network and giving access to the external collaborator to remotely connect to the network, funds can be transferred out of customers’ or internal accounts, fictitious invoices/claims could be raised, malware could be installed while confidential information and trade secrets could be disclosed or stolen. The attraction for using remote access tools for this purpose is to conceal the identity of the insiders who facilitated the fraud. Usually, login credentials of unsuspecting users would have been stolen using key loggers (hardware or software) or password crackers to divert attention from the perpetrators and further make investigations into such fraud complex and inconclusive.
Below are some security practices that could facilitate the abuse of remote access tools on the network.