Teamviewer hacked, completely insecure

As we all know, teamviewer use is generally bad practice. But for anyone who has it installed, if that machine has been on in the last two weeks it probably has had someone try to access it via teamviewer. Even if your financial accounts haven't been hit yet many users are reporting their caches were looked at (to get at passwords) and viruses left behind.

More info at: https://www.reddit.com/r/teamviewer/

Glancing it over its still "denied" by TeamViewer....

This is why Cloud solutions are so insecure. Because they rely on the security of a external server, that imposes a insecure password authentication.

Thats why its better to have a locally hosted remote control, like VNC or something. Even if VNC is unencrypted and "insecure" in that fashion, its more secure because you can in the router port forward configuration, limit the port access to a subset of a specifically accepted IP-numbers.
Then it won't matter if someone has your VNC password, they must be from the right IP too.

That is nice if its fixed IP's, but in a lot of places they have dynamic IP's, which make it a problem. Also, spoofing a IP and relay traffic is maybe a bit harder, but not impossible to do... knowing which source IP is then "key",
And also be possible by being so close that the spoofed IP's get routed over a controlled network to redirect the traffic... which is pretty hard, but depends on the ISP of the victim. There are plenty of poor country ISP's or bad ISP's that don't configure it well or update their routers with newest OS / Firmware etc to protect against exploits.

Ofcourse, if someone is able to do that, then the remote desktop VNC is .... far beneath them, for they can get a very well paid job at any ISP or network provider on securing their stuff.

It should not be difficult for them to secure it for real. Problem is, they want control, which is the actual problem. If the account was purely for accessing their services by using their forwarding servers for passing the firewalls via the clients, then it would be valid, encryption from client to client, and not using the account to "authenticate" the connection, but a local saved key pair that gets authenticated upon connect. Not having keypair on clients? re-auth the remote admin... Ofcourse, the keypair should with every end of the connection be updated...

nice and all, but on the reddit thread where also ppl hacked that had actual 2 factor authentication on when this happened.... read somewhere in an article a IBM security researcher had this happen to him.