In those cases, the matching substring is shorterвЂ“only 0x031724475000.ДЄt this point, I went back to revisit the unintelligible TCP data to the TeamViewer infrastructure devicesвЂ“communications that occurred with TCP port 5938. By searching for $GP, I came across some of the earlier sessionsвЂ“also via UDPвЂ“that were related to TeamViewer (see the payload in Figure 6). Whenever I find fragments of data that seem to be repeated for no clearly discernable reason, I start to explore.

Interestingly, each of these three packets were identical in size, as well as source and destination ports!ДЇigure 8: Interesting private and public IP communicationsUpon a closer look at the payloads of each packet, I noticed that each had the destination IP address (as a string) and destination port (in little-endian form)вЂ“plus a handful of leading bytesвЂ“as the only non-zero content.ДЇigure 9: Learning IPs and ports via the payloadThese leading bytesвЂ“ 0x03172447500005вЂ“struck me as odd, especially because a subset of them produced a human-readable string ( $GP). Looking closer, I saw that there was yet another foreign (to my network) private IP address being contacted, followed by a public IP address. It was around then that I noticed a UDP session that was attempting to communicate with an RFC1918 private IP address that did not exist on my local private network! I began paying attention to communication that was occurring nearby these flows that I couldnвЂ™t explain away. In this capture, I did also connect to a colleagueвЂ™s system across the InternetвЂ“where is that data?! Detailed ObservationsДЇirst, a number of sessions (both over UDP and TCP) communicate on port 5938. However, again, there is no readable information.ДЇigure 6: Unreadable UDP dataAt this point, there is very little information we know, except that some sort of communication is occurring with TeamViewer infrastructure devices. For example, Figure 3 shows that there are communications on barebones TCP, as well as TLS.ДЇigure 3: TCP and TLS communicationsAs some of the earlier conversations continue or die off, yet more spin up.ДЇigure 4: More TCP communications startThere are some larger packets visible in this data, butвЂ“unlike LogMeInвЂ“the data is unreadable.ДЇigure 5: Unreadable TCP dataInterestingly, much later in the capture we find communications occurring over UDP as well. When trying to keep track of what communications exist with these infrastructure devices, itвЂ™s clear that thereвЂ™s a lot of things going on.ДЇigure 2: Communications with several infrastructure devicesThere are several connections occurring simultaneously to 7 different servers within the infrastructure. However, itвЂ™s important to know that most of these servers are not actually owned by TeamViewer. Some of these IP addresses change over time, while others seem to be mostly static. Initial ObservationsД«y observing the DNS names, weвЂ™re able to see that TeamViewer has very easily-identifiable domains and subdomains, and includes several disparate IP address ranges.ДЇigure 1: Identifying IPs and SubdomainsIn fact, at the time of this writing, there are 16 master servers ( master1 вЂ“ master16), hundreds of normal servers across numerous IP ranges, as well as a number of other publicly-reachable infrastructure devices. Each of these occurrences take advantage of the fact that TeamViewer is a common remote support tool and can aggressively avoid attempts to detect or block it. Additionally, a piece of malware named SkywyderвЂ“which I found on the Dark Web sometime in mid 2016вЂ“leverages TeamViewer. Since then, the Shade ransomware took advantage of TeamSpy, andвЂ“ more recentlyвЂ“other spam campaigns have been using it. In 2013, a report came out that discussed how a surveillance tool named TeamSpy had been using TeamViewer for roughly a decade. TeamViewer has been part of the threat actorвЂ™s arsenal for years. Now itвЂ™s time to learn what TeamViewer has up its sleeve. In our first foray into this subject, we learned about the types of techniques LogMeIn uses and how they can circumvent security controls. Given these tools make the network perimeter more permeable than security teams may realize, it is important to know who is initiating the connection, and where the communicating devices reside - especially if this isnвЂ™t the approved remote access solution. In the original post of this series, I set the stage for why remote access capabilities should be analyzed more carefully.

Transfer files using teamviewer 9