Teamviewer "hack" following remote access - some advice needed to prevent it occurring again.

[kealahavens]

Hello out there in apple land!

First time poster, long time lurker. I'd really appreciate some advice on a pretty ****** happening which occurred last week:

I woke up on 11/2 to an unfamiliar screen orientation and layout on my M1 MBP. It was immediately clear that someone had gotten into the computer based on the fact that teamviewer was open (and wasn't previously installed) and several sensitive documents were saved to my desktop (copy of my DL and passport etc). The rest is pretty boring and boiler plate,they logged into venmo/paypal/my bank/amazon and bought a bunch of gift cards, changed gmail preferences to delete any incoming emails and deleted all of the emails that must have come in with all of these purchases. All told got out with quite a haul after maxing some cards and making transfers - in the realm of $19,000.

Generally I consider myself to be fairly savvy on any computer, and moreso on a mac than anything else. Whoever did this left some tracks because they forgot to clear browsing history and did all of their business within my browser. I've done the basics already - changed computer/gmail/paypal/vemno/wifi/social media/ALL THE REST passwords, gotten all the accounts closed and into fraud investigation processes, and frozen my credit with the 3 credit agencies. I've also gotten myself a VPN (ExpressVPN) for the time being, reinstalled little snitch (had it previously but it breaks Cascable Pro Webcam which I use for work so it wasn't currently installed), and have been turning off Wifi at night/when i'm not using the computer just in case.

Prior to making any changes I screen shotted everything visible including browser hx and etc, and also did an immediate search (after turning off wifi) for recently modified/open files so I have a good idea of what they got into and what they didn't. I ran malware/virus scans (although i'm on Ventura so Malwarebytes isn't supported currently), I've also downloaded and run EtreCheck which didn't identify any issues.

Here's the 2 questions I specifically am needing help with answering:
1. How did this person access my computer initially (since the first action taken was to download team viewer from Firefox obviously it wasn't the initial point of entry).
2. What information would someone need to remote into the computer to do this assuming there's no 3rd party screen sharing software on the computer (no webex/no teamsviewer), only apple remote desktop and the apple screen sharing app.

I've tried to use terminal commands to view recent screensharing authentications but none are showing up at all.

Any help appreciated!

 

[sgtaylor5]

I run a computer repair business and in this case I think you need a professional. Are there any colleges nearby that offer computer science/forensics that could help you?

 

[kealahavens]

I run a computer repair business and in this case I think you need a professional. Are there any colleges nearby that offer computer science/forensics that could help you?

I work in psychiatry so no colleagues who can help perse… but I’d be interested in your thinking behind thinking I need to find a professional service to help. Did something in my description make you think this wasn’t just a random attack where someone just happened to find an exploitable vulnerability, and was instead something targeted at me specifically?

 

[sgtaylor5]

It could have been a random attack, though Macs are inherently more secure there's always things that get missed.

No, just more experience and knowledge at tracking down where they got in. Forensics is a complex field and I'm not an engineer. Never thinking they targeted you specifically.

 

[kealahavens]

It could have been a random attack, though Macs are inherently more secure there's always things that get missed.

No, just more experience and knowledge at tracking down where they got in. Forensics is a complex field and I'm not an engineer. Never thinking they targeted you specifically.

Understood - and very fair point. I wouldn’t even know where to start looking for a service like that, or even if I could afford it. Community psychiatry isn’t the field to go into if you’re hoping to make $$$. I get the feeling this is way beyond the skill set of your average geek squad member…

 

[Queen6]

Try KnockKnock that may reveal further details. BlockBlock will do just that and stop & warn of any persistent code attempting to install.

Likely entered via the browser and or a spoofed website. They only need your IP on an unprotected connection and the right tool. VPN's don't do much for anonymity, however they can help to protect from such attacks as all traffic is encrypted with many offering private DNS servers.

Just like all criminals they look to attack the weakest point of entry unless you were specifically targeted which is a deeper issue. The solution to security on any OS is multiple layers.

If you plan to go forward with any forensic analysis stop using the computer as this will only serve to degrade the data/evidence. If not, backup your user files and reset your Mac as it has very clearly been compromised and you're very likely to get hit again in the short to midterm...

Q-6

 

[Queen6]

@kealahavens btw If you reset your Mac, change all your passwords again. The intruder likely has admin if not Root access so anything you do, he/she can see and capture all...

You should also report the incident to the police if for no other reason than to have it documented as this is a classic case of identity theft that seems the culprit botched by leaving obvious evidence. The larger concern is the criminal may use or sell your details to in order to fraudulently loan money or purchase goods on credit...

Q-6

 

[antiprotest]

I wish you knew for sure how this happened so we can all learn something from this.

 

[mi7chy]

Sounds like a RAT infection. Do you recall what software was downloaded and installed within the last several days?

Good practice to lock your screen when away from computer. I take it one step further and null route when PC screen is locked which is natively supported on Windows with Task Scheduler. The equivalent on MacOS would be something like EventScripts but haven't looked too much into it since I don't do any banking/purchases on MacOS.

 

[Queen6]

I wish you knew for sure how this happened so we can all learn something from this.

KnockKnock & BlockBlock, one must not confuse malware with being hacked. If a bad actor can't see you, he/she can't act against you...

Q-6

 

[Queen6]

Sounds like a RAT infection. Do you recall what software was downloaded and installed within the last several days?

Good practice to lock your screen when away from computer. I take it one step further and null route when PC screen is locked which is natively supported on Windows with Task Scheduler. The equivalent on MacOS would be something like EventScripts but haven't looked too much into it since I don't do any banking/purchases on MacOS.

DL just need to check the CRC on any OS makes for good sense. Numbers match your good, if they don't steer away...

Q-6

 

[richmlow]

Hello out there in apple land!

First time poster, long time lurker. I'd really appreciate some advice on a pretty ****** happening which occurred last week:

I woke up on 11/2 to an unfamiliar screen orientation and layout on my M1 MBP. It was immediately clear that someone had gotten into the computer based on the fact that teamviewer was open (and wasn't previously installed) and several sensitive documents were saved to my desktop (copy of my DL and passport etc). The rest is pretty boring and boiler plate,they logged into venmo/paypal/my bank/amazon and bought a bunch of gift cards, changed gmail preferences to delete any incoming emails and deleted all of the emails that must have come in with all of these purchases. All told got out with quite a haul after maxing some cards and making transfers - in the realm of $19,000.

Generally I consider myself to be fairly savvy on any computer, and moreso on a mac than anything else. Whoever did this left some tracks because they forgot to clear browsing history and did all of their business within my browser. I've done the basics already - changed computer/gmail/paypal/vemno/wifi/social media/ALL THE REST passwords, gotten all the accounts closed and into fraud investigation processes, and frozen my credit with the 3 credit agencies. I've also gotten myself a VPN (ExpressVPN) for the time being, reinstalled little snitch (had it previously but it breaks Cascable Pro Webcam which I use for work so it wasn't currently installed), and have been turning off Wifi at night/when i'm not using the computer just in case.

Prior to making any changes I screen shotted everything visible including browser hx and etc, and also did an immediate search (after turning off wifi) for recently modified/open files so I have a good idea of what they got into and what they didn't. I ran malware/virus scans (although i'm on Ventura so Malwarebytes isn't supported currently), I've also downloaded and run EtreCheck which didn't identify any issues.

Here's the 2 questions I specifically am needing help with answering:
1. How did this person access my computer initially (since the first action taken was to download team viewer from Firefox obviously it wasn't the initial point of entry).
2. What information would someone need to remote into the computer to do this assuming there's no 3rd party screen sharing software on the computer (no webex/no teamsviewer), only apple remote desktop and the apple screen sharing app.

I've tried to use terminal commands to view recent screensharing authentications but none are showing up at all.

Any help appreciated!

Wow...that is quite a story!

In the aftermath, you have done all the right things.

What you now need to consider are the following (in no particular order):

1. How did the "break-in" occur? If this cannot be determined, eventually you will make the same
mistake again and be susceptible to the same type of attacks.

2. I consider your M1 MBP completely compromised. I operate under the assumption that malware, trojans, viruses, etc. have been installed and have NOT been removed, despite your best efforts. Being paranoid, I would take the following steps: 1. Make a backup of all critical data and applications. 2. Completely reinitialize the HD / SSD. 3. Do a brand new installation of macOS. 4. Restore all critical data and applications.

3. Go to Security Preferences. Activate your firewall. Also, go to the firewall options and "Block all incoming connections." Enable "Stealth Mode." Do not allow screen sharing, file sharing, etc.

Good luck and all the best.


richmlow

 

[mi7chy]

Also look into security token to protect your banking and email accounts when desktop and therefore MFA email, SMS, iMessage, etc. are compromised.

https://www.yubico.com/

Not all services support security token so you have to be selective.

https://2fa.directory/us/

 

[Fishrrman]

Ahem.

Would this still have happened (at night) if you had simply shut the Mac down (powered all the way off) each night?

Sometimes "savvy" = simple.