Re:TeamViewer denies hack after PCs hijacked, PayPal account...
by swozey on Thursday June 02, 2016 @11:09PM
(#11828037)
Do you have a system to block, mitigate or monitor for "strange" IP blocks accessing systems they've never accessed before? It's a great idea if not. We have, unfortunately, had to do this in webhosting/billing for a long time due to the amount of fraud from specific blocks.
Not as dynamic, but for instance LastPass will allow you to blacklist or whitelist entire country IP blocks. A system that also monitors (on your end, or maybe alerts the customer) that their machine in Kansas all of a sudden has multiple IPs from China/whatever accessing it (on your end seeing this globally through the network as well) would be great to mitigate events like this. If you go on vacation, you can remove the block.
So far every report I've seen has been Guangzhao/Yangzhao in the access reports. Could easily, easily nip that in the bud. Obviously other proxies could be used but something like a remote access system is something people should be locking down tightly.
Another way we protect hosts is by not allowing random hosts and clients to communicate with each other unless you've given explicit permission to each host/client. This means that Bob can't load up the Jump Desktop client and try to randomly brute force Alice's local account password by trying to connect repeatedly. The cloud server will drop Bob's connection requests to Alice unless Alice has explicitly given Bob permission to connect.
The above applies to our zero setup app, Jump Desktop Connect. Jump Desktop is also a full blown RDP and VNC client (with SSH support) - so you don't really have to use the Jump Desktop Connect app if you don't want to. You can use traditional RDP / VNC-over-SSH to establish secure connections as well.