It doesn't sound like they have been hacked directly. This looks like the same things as TeamViewer where hackers are using password lists from other breaches to attempt to compromise the high value remote desktop targets.
GoToMyPC has been hacked, all customer passwords reset
81–90 of 171 posts
Re: GoToMyPC has been hacked, all customer passwords reset
#82It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.
> It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore?
Very few users can run their own web servers. We used to deploy GoToMyPC for users; it was reliable, performed well, platform independent (including mobile), and secure. I expect it still is.
When the new OS or other new tech came out, GoToMyPC handled any compatibility issues; we didn't have to worry. No matter what the user's remote computer was, it worked (as long as there was an Internet connection). The security was good too: End-to-end encryption, optional one time pads, and even details like blanking the screen of the host machine so that someone in the room with the host couldn't monitor what the user was doing.
We stopped using it because we didn't need it any more, but we were happy customers for many years until that point.
Re: GoToMyPC has been hacked, all customer passwords reset
#83Earlier quoted context omitted.
Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.
If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain
Same argument for port knocking. Absolutely ineffective against targeted attacks, but most attacks aren't customized and targeted.
Re: GoToMyPC has been hacked, all customer passwords reset
#84Earlier quoted context omitted.
Use a password manager. One strong password per site. https://www.keepassx.org/ Also, use 2FA wherever available. Google Authenticator is good enough. Store your backup codes somewhere safe (your keepass db, for example. Although that goes a bit counter to the point of 2FA, if someone cracks your keepass db, you're pretty screwed regardless).
There is still a major annoyance with Google Authenticator etc.: When you switch your device, you have to set up your 2FA credentials again …
Authy solves this problem and lets you share among devices.
Re: GoToMyPC has been hacked, all customer passwords reset
#85As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I have a "things I don't care about password" that's long, easy to type, and easy to remember. It's about 20 characters, which is sufficient for most services that don't have two-factor authentication, but annoying because some archaic systems STILL have a maximum password limit for ridiculous reasons that suggest one-way hashes are not being used.
Wherever two-factor is available, it's turned on. Usually through my phone, which has its own passcode and won't display text messages on my screen. I'm curious as to how secure this really is, but I suspect this is reasonably difficult enough to hack that someone would have to be targeting me specifically to be able to reliably pull my SMS token out of the air and match it up to my login before I used it within a few seconds and invalidated it. If someone decides to target me specifically, I have bigger problems.
For my email, my banking sites, and all the things that I really would rather someone else please not log into, I have a unique password. This is still long and easy to type; the only advantage of these passwords is that I am sure to not share them in any modified form anywhere else on the internet, which protects against these sorts of cross-site password theft attacks. (Even for my shared password I have a pattern that makes it uniqueish, but that pattern is simple enough that a human could probably reverse engineer it.)
The only real exception to this strategy is things that can be password-less, though that carries its own weirdness. All of my remotely-accessible SSH servers use private key authentication and have passwords enabled for sudo, but don't allow SSHing in using that password. (So they are effectively single-factor for login and userland access, which can still do a lot of damage but requires a computationally difficult key, and two-factor for root access.) This carries its own issues; I have to keep my private key files somewhere, and even if I use multiple keys for each machine I log in from, all it takes is one rogue login to hose my server. I either put all my eggs into one basket by using some sort of encrypted store, or I spread out my attack surface, increasing its complexity, and decreasing the chance that I'll have successfully patched all the holes up. I also don't like that there's no way I could reasonably memorize a private key, so the option of NOT storing it kind of doesn't exist. At best I can try to protect the key in some way.
Re: GoToMyPC has been hacked, all customer passwords reset
#86This is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.
> This is not a good suggestion on their part, and has long been proven ineffective: Agreed; that is bad advice. I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g.,…
Are there any good sources on what sort of generative trickery a good cracking tool will use?
I've noticed that the OSX Keychain 'memorable' password suggestions are almost always /(\w+\d+[[::punc::]]+\w+)/, which is enough of a pattern to probably make an explicit generator for which will match much faster than a naive brute-force.
Re: GoToMyPC has been hacked, all customer passwords reset
#87Earlier quoted context omitted.
In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router. One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set…
If you're on a Windows system this is even easier. Go to System -> Remote Desktop Connections and check the box to enable incoming connections. On your router, forward port 3389 to the machine you want to access. On any client device running Windows (linux/mac can use FreeRDP, for which there are numerous wrappers) connect to your home's Public IP, and log in with your computer's usual username and password. For the…
they also dodge the need to set up port forwarding, which is why we use it on our kiosks when the customers don't want to set up port forwarding.
Re: GoToMyPC has been hacked, all customer passwords reset
#88As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I'm hashing my passwords. For example, when logging into any google service, I use: echo "secret123|google" | sha1sum where "secret123" is my master password (I use a much longer one actually to be safe). Similarly, on facebook, I woudl use: echo "secret123|facebook" | sha1sum To both passwords, I add "Aa1!" to make it pass the capital/lowercase etc. tests. EDIT: it is best to write a script for this
I do something similar but I'm not happy about it at all. But I'm also afraid of password managers themselves becoming compromised.
Re: GoToMyPC has been hacked, all customer passwords reset
#89It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.
> It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Very few users can run their own web servers. We used to deploy GoToMyPC for users; it was reliable, performed well, platform independent (including mobile), and secure. I expect it still is. When the new OS or other new tech came out, GoToMyPC handled…
> optional one time pads
Any good reason why this wouldn't be the default? Speed + key exchange transmissions, maybe?
Re: GoToMyPC has been hacked, all customer passwords reset
#90Earlier quoted context omitted.
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
I am switching away from unique mail addresses … I used a mix of catch-all and plus characters: The former reduces the efficiency of your spam filter, the later is not (fully) supported by many websites. AirBnB for example allowed me to set an mail address with a plus character, however, login did not work anymore, so I was locked out and had to create a new account … AirBnB support refused to change my mail address…
Add grep whitelist to your spam filter for some arbitrary extension, e.g. a tld such as '.com'.
This way the address can be some-web-app.somecompany.com@yourdomain.tld, you can whitelist *.com@ (or higher up on the subdomain if necessary).
Not sure if this would maintain the efficiency of your (or any) spam filter, but it does avoid the '+' character.