Potential Security Risks of Remote Access/Control Software on Corporate Networks

Remote access software (a.k.a. remote control software) are very useful tools that serve in different occasion, from enabling your support vendor who is located 3000 miles away troubleshoot a server or network incident, to remotely performing administration function on servers running in your Hong Kong data center from your London office. Remote access software is a valuable tool for the mobile workforce. It can especially be useful for small businesses that may not have staff onsite to perform certain tasks or big businesses who wish to cut down on their support cost. They can be unavoidably required in situations where a client organization’s technical support vendor is thousands of miles away (say in New York) and an issue requires the vendor staff to access a server or device within an organization’s network that is located in Lagos for just 30 minutes to fix a matter. It really won’t make sense to fly the vendor staff down to Lagos from New York to fix an issue that can be resolved in 30 minutes. Remote access tools could be used in such situations, which would save a whole lot of cost and logistics.

Generally, to remotely access a computer, it is required that some sort of software is installed on the computer you wish to connect to, known as the host. Once that is done, a connection can be made from another computer or device with the right credentials, known as the client to control the host. There are several remote access software in the market, which are not limited to Teamviewer, Dameware Mini Remote Control, Remote Utilities, UltraVNC, AeroAdmin, RemotePC, etc. Teamviewer is the most popular among all of them and present the best and broader features. With support for remote control, video, voice calls, and text chat, TeamViewer also allows file transfers, supports wake-on-LAN (WOL), and can even remotely reboot a PC into Safe Mode and then reconnect automatically. Teamviewer comes in installable version, portable version called TeamViewer QuickSupport (for one off remote control or if administrative right or installing software on the host PC isn’t possible) and lastly, the TeamViewer Host if regular usage of the software is required. Remember, no changes to router or firewall configurations are needed.

Despite the convenience and cost saving being brought to bear with these tools and as vital as remote access software has become, it also presents serious security risks to the organization if its use is abused. If there are any vulnerabilities in the software, a simple breach somewhere in the system can give a hacker free entrance into a network and all of its data. The most disreputable of all security incidents involved a retail giant, Target (a US Company) where hackers gained access through a remote access software used by a third-party vendor and breached payment card data of its customers. Beyond software vulnerabilities, the most worrisome are incidents of abuse from users and administrators alike.

The Big Question

As the Chief Information Security Officer (CISO), Chief Compliance Officer (CCO), Chief Audit Executive (CAE) or persons that have responsibility for information security in an organization, do you know who are connecting to your network via remote access tools like Teamviewer and for what purpose? Do you have data on the number of users and administrators that made use of these remote access tools in the past one year and the purpose? Are authorizations required before such tools are used on the network? How sure are you that disloyal or disgruntled employees and even the ignorant ones are not opening backdoors or poking holes on your network unknown to you? Have you scoped some of the potentially unwanted programs (PUPs) like remote access tools in your enterprise security monitoring? A lot of questions begging for answers.

What Risk Do You Face?

Organizations that do not restrict the use of remote access tools stand the risk of their network being breached by fraudulent vendor staff, disgruntled employees as well as syndicate of fraudsters targeting the organization. By not uninstalling/deleting a remote access tool previously used for an authorized support, a vendor staff could reuse the tool to subsequently connect back to the organization’s network without authorization. Disgruntled and fraudulent employee in collaboration with external elements could cause damage not limited to denial of service, financial loss or reputational damage to an organization. By installing or copying the remote access tool into PCs within the organization’s domain network and giving access to the external collaborator to remotely connect to the network, funds can be transferred out of customers’ or internal accounts, fictitious invoices/claims could be raised, malware could be installed while confidential information and trade secrets could be disclosed or stolen. The attraction for using remote access tools for this purpose is to conceal the identity of the insiders who facilitated the fraud. Usually, login credentials of unsuspecting users would have been stolen using key loggers (hardware or software) or password crackers to divert attention from the perpetrators and further make investigations into such fraud complex and inconclusive.

Below are some security practices that could facilitate the abuse of remote access tools on the network.

1. USB port and CD drive access:

It is all about endpoint security management. In a network where USB port and CD drive are open to all users, remote access software such as Teamviewer can be copied into a PC in the network without being detected.

2. Software installation right:

This speaks to the acceptable use of computer/ information assets policy of your organization. Are non-administrative users allowed to install software on their official workstations without authorization? If this right has been given to every network user via the Active Directory (AD), then the organization have a lot to worry about. This means that users who successfully copy or download any remote access tool can install them on their official PCs without restriction. As such, you will need to weigh the risk and benefit of giving out this right to users. It needs to be noted that the right to install software may not apply to Teamviewer QuickSupport (copy and use) version as it does not require installation before usage.

3. Administrative right on the host PC:

For organizations that allow users to have admin rights on their official PCs, they should think again. With this rights, users can install any software they so desire without any restriction. In some cases, support personnel that set up new workstations (Desktop or Laptop) for users set a blank password for the local Administrator account on Windows thereby making it easy for users with malicious intentions to use them to install software like remote access tools.

4. Internet access via web proxy server:

Organizations running a domain network allow users access to the internet via web proxy server. To successfully use remote access tools, the host PC must be connected to the internet. Most remote access tools (e.g. Teamviewer) use web proxy server settings of the host network to connect to the host PC and in most cases, web proxy server parameters (i.e. proxy server IP address and port number) are set as default for remote connection. This is the main attraction for the use of remote access tools for fraudulent and unauthorized activities.

When a Teamviewer client connects to a host PC in an organization’s network over the internet, it does so via the web proxy server settings on the host network. The implication of this is that the audit trail of the client user’s activities via Teamviewer will show the proxy server IP address rather than the local IP address of the host PC/workstation. For example, if funds are moved from customers’ accounts using that remote access connection, the IP address that will appear in the transaction audit trail is the web proxy server IP instead of the host PC’s local IP address. This will pose a huge challenge during investigation to unravel the location and PC from where the funds are moved.

Would you imagine a scenario where processors’ login credentials on a core banking application were stolen/compromised using hardware or software key logger or password cracker and Teamviewer was used in the manner described above to perform the funds transfer. Would you have the slightest chance of knowing the PC or location from where the transactions were carried out if all you could see in the transaction log is the web proxy IP address? Fraudsters or attackers use this technique to ensure no trail of their activities is left. The options open to the organization are to either hold the processors whose login credentials were compromised accountable for the fraud, which might not be fair in circumstance where their passwords were stolen by no fault of theirs or if the network admin guys set up an access list on firewall that could resolve all inbound IPs that used the proxy server to an internal IP address. Either way, the organization has lost money and may not get the real perpetrators of the incident. To be sure that your intranet is adequately secured with the minimum security baseline, benchmark your domain settings against this audit program/security baseline and ensure you close identified gaps as recommended.

Mitigation of the Risks Posed by Remote Access Tools

1. Restrict the use of USB ports and CD drives:

USB and CD drive access should only be on the need-to-have basis while management approval should be obtained before such access is given. Restricting access to USB ports and CD drives can be achieved using endpoint management tools such as McAfee ePO.

2. Restrict software installation right:

This right should be withdrawn from all Domain users and given to only Administrators that carry out support and domain admin functions or those that may have need for it.

3. Implement transaction audit trail:

Ensure that transaction audit trail includes vital information that would aid investigation activity when the need arises. The audit trail should capture information such as; date and time of transaction/activity, IP address of the computer used for the transaction/activity, type of transaction/activity, location from where the transaction/activity was done, transaction status, failed and successful login trail. These are information that will give you a clue of what happened during investigation.

4. Install CCTV cameras in work areas:

Where everything has failed, this control might just be what will save the day from experience. In a situation where you couldn’t figure out from which location the Teamviewer was used but have locations or persons that are suspects based on transaction evidence collected, this could help you to solve the puzzle. Most of the time, you will see when the user plugged the external storage device or hardware key logger on the PC USB/PS2 port when the CCTV is played back.

5. Endpoint Security Management:

Profile teamviewer, dameware, remotepc, wireshark, password cracker, software/hardware key loggers and others as potentially unwanted programs (PUPs) in your endpoint management software (e.g. McAfee ePO). You will be amazed at the number of users that already have these tools installed on their PCs. This will show you how exposed your organization has been and the level of breaches that could have happened that were never detected or reported. Where there are incidents that you suspect teamviewer or other remote access tools were used (e.g. seeing your proxy server IP address in transaction log), profiling the above listed PUPs and more will in minutes check the network to detect where they have already been installed and delete their executable files (.exe files) immediately. This will give you clue on who could be behind the attack as perpetrator would most likely not delete teamviewer files or uninstall it after use. Also ensure that all PCs on the network have the latest antivirus software (McAfee) agents installed on them. This is the only way rules set on the endpoint software can be effectively enforced on all PCs on the network. You can get audit program/checklists for windows infrastructure, intranet and internet security and more here

6. Systems to be used on the network must be joined to the domain:

This is important in ensuring that all domain rules and policies are enforced on the network including configurations made on the endpoint software. As a matter of policy, no system should access resources or acquire IP address on the network without being joined to the domain. Good network access control (NAC) tools can be used to achieve compliance.

7. Put in place a good acceptable use of computer/information assets and Bring-Your-Own-Device (BYOD) policies:

Define the ground rules for use of computer and information assets on the organization’s network including bring-your-own-device. All that have been discussed in this article and more should be captured as part of the policy (get details test procedure for intranet and internet security best practices. The organization should determine software that are not allowed on the network and exceptions to such rules. Ensure that users are continually sensitized on the dos and don’ts in the network. Put sanctions in place to serve as deterrent and to ensure total compliance.

8. Ensure that remote access tools are deleted or uninstalled after authorized use:

Where remote access tools like teamviewer are exceptionally approved for use on the network to resolve a support issue, ensure that they are deleted or uninstalled from the host PC. It is not uncommon that unscrupulous employees or vendor staff leave used remote access connection active to enable them get back into the system without the users or management consent. To ensure that TeamViewer is not active on startup of Windows, Start Teamviewer, right click the tray icon and go into "Options". See if it's set to "Start with Windows". If so, turn it off. Under Security, check if there's a password entry. If so, change the password to lockout the external party who may have knowledge of the password. Make sure Windows Logon is set to "not allowed".

Nwabueze Ohia

(Tech Blogger, Cybersecurity Consultant & Author)

Will appreciate your questions and contributions on this post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at info@oxleyconsults.com.ng.