On 22 Jul 2009 at 23:32, Gavin Wilby wrote:
> Hi,
>
> Came across this today (teamviewer.com) free for non commercial use.
You might want to read this article from TheReg today:
------- Included Stuff Follows -------
Remote IT support tool hijacks customer webserver o The Register
On Thursday morning, IT consultant Paul Nash received an urgent call from
a client whose Apache webserver had crashed the previous night and
inexplicably wouldn't restart. Equally vexing, people who tried to visit
the client's website during the 10-hour outage received a message
advertising TeamViewer, a maker of widely used software for remotely
managing PCs and servers.
After 90 minutes of troubleshooting, Nash traced the problem to
TeamViewer, which he used to remotely administer the client's servers. It
turns out the program had opened up its own webserver on the client's
machine as soon as Apache went down and in the process made it impossible
for the client, a large provider of business software, to restart its
proper website.
"At that point, basically the webserver is hosed because if Apache tries
to start up again, it sees someone else on port 80 and it falls over and
dies, which is kind of antisocial behavior," Nash, who is the principal at
Toronto-based Nash Networks, told The Register. Nash was able to get
Apache up and running again by killing TeamViewer processes on the server,
but by then, the client "had quite a bit of irate support requests stacked
up."
The incident highlights a serious liability that comes from using what he
otherwise regards as a great tool for remotely managing the thousands of
PCs and servers entrusted to him. But what really sticks in Nash's craw,
he said, is the blase attitude TeamViewer support people showed when he
reported the SNAFU.
"They said they don't see what the problem is," he said.
After he escalated the complaint, Nash finally received instructions for
modifying the registry of machines running TeamViewer so its webserver
won't automatically start should the normal webserver go down. But this
requires him to put his hands on every machine he manages, a solution
that's needlessly cumbersome.
Also concerning, said Nash, is TeamViewer's lack of disclosure that its
software is receiving incoming traffic sent to machines that run the
software.
"They're sitting in the middle and they're in a position to snoop on all
my traffic," he said, adding that he thinks that scenario is unlikely.
Still, when Nash learned that TeamViewer does monitor for incoming web
requests, he said it made him wonder: "What else aren't they telling us?"
--------- Included Stuff Ends ---------
More here with links:
http://www.theregister.co.uk/2009/07/24/teamviewer_snafu/
--
Angus Scott-Fleming
GeoApps, Tucson, Arizona
1-520-290-5038
+-----------------------------------+
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
