Open-AudIT

What's on your network?
It is currently Sat Jan 20, 2018 5:14 pm

All times are UTC + 10 hours




Post new topic Reply to topic  [ 10 posts ] 
Author Message
 Post subject: Teamviewer
PostPosted: Sat Feb 20, 2016 2:07 am 
Offline
Newbie

Joined: Fri Dec 25, 2015 1:56 am
Posts: 28
I just found an old topic (viewtopic.php?f=20&t=6033&hilit=teamviewer) about teamviewer.

Is this still included in the current version? I'm at v1.8.4, but I can't seem to find the items. The computers have teamviewer v8 installed.

thanks


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Sat Feb 20, 2016 6:55 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1226
audit_windows.vbs has a section for auditing the license key for TeamViewer 6 through 8. Search for "TeamViewer 8" in audit_windows.vbs to see what it does.

I don't use TeamViewer so I can't test. You could post (or PM) the registry key info it audits (removing anything that should be secret): HKLM\Software\TeamViewer\Version8 or HKLM\Software\Wow6432Node\TeamViewer\Version8.


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Sat Feb 20, 2016 7:46 pm 
Offline
Newbie

Joined: Fri Dec 25, 2015 1:56 am
Posts: 28
Thanks for the reply, but it doesn't seem to be working.

I've ran the audit_windows.vbs, but the xml results only contained references to the service and .exe as installed software. The ID wasn't in the result.

However, the registry key you mentioned ( HKLM\Software\Wow6432Node\Teamviewer\version8) is the correct location.


On a sidenote these are the locations for v9 & v10:
v9:
HKEY_LOCAL_MACHINE\SOFTWARE\TeamViewer\Version9
v10:
HKEY_LOCAL_MACHINE\SOFTWARE\TeamViewer\


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Sun Feb 21, 2016 4:03 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1226
I understand that it's not working but can't do anything to help you as I don't have TeamViewer. The audit code is open in audit_windows.vbs. Step through the code and your registry keys to see why it is failing.


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Mon Feb 22, 2016 9:45 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1933
Location: Brisbane, Australia
+1 what JPA said. I don't have TeamViewer either so I'm of no use.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Thu Apr 07, 2016 12:20 am 
Offline
Contributor
User avatar

Joined: Thu Mar 02, 2006 4:41 am
Posts: 182
Location: Massachusetts
Just checked in our OA system, found 1 computer with "TeamViewer 10"!

I looked here

HKLM\Software\Wow6432Node\Teamviewer

no refs to "TeamViewer 10" (see attached TeamViewer.jpg for all details found here)

I think OA may have found "Teamviewer 10" here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TeamViewer\ (see 2nd attached JPEG TeamViewerSvc.jpg)


Attachments:
TeamViewerSvc.jpg
TeamViewerSvc.jpg [ 115.85 KiB | Viewed 2863 times ]
TeamViewer.jpg
TeamViewer.jpg [ 243 KiB | Viewed 2863 times ]

_________________
Server Info: running on a CentOS 7 vm
OA Version: 2.0.6 @ 500 devices
Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Thu Apr 07, 2016 3:47 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1226
That is useful information but now I'm wondering what we're trying to audit. OA attempts to audit name, ClientID (key?) and release number for TeamViewer 1 through 8 but only ClientID was actually pulled from the registry. The ClientID is supposedly the TeamViewer license key which is what OA is trying to audit.

It looks like TeamViewer has changed their registry key format a bit. From your screenshot we have TeamViewer installed into the "TeamViewer 9" Start Menu group, with a Version of 10.0.47484 and an UpdateVersion of 11.0.56083 and a number in ClientID. Again, we don't use TeamViewer so I'm not sure what you would like audited. Keeping in mind this is for auditing license keys. Actually, is this supposed to be secret? Should you remove the screenshot with this info?

Given all that how should those map into Open Audit key storage of "name, string, rel, edition"?


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Sat Apr 09, 2016 12:32 am 
Offline
Contributor
User avatar

Joined: Thu Mar 02, 2006 4:41 am
Posts: 182
Location: Massachusetts
Hi jpa-

I posted the screenshots, trying to help out vanderheyde. I don't use TeamViewer either, and I'm not sure why somebody installed it on one of the vm's. I doubt the end user purchased a license. Where is the license detail in these screenshots? I guess if I can find it I could black it out and re-upload.

thanks

_________________
Server Info: running on a CentOS 7 vm
OA Version: 2.0.6 @ 500 devices


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Sat Apr 09, 2016 12:41 am 
Offline
Contributor
User avatar

Joined: Thu Mar 02, 2006 4:41 am
Posts: 182
Location: Massachusetts
Disregard my prev question. I checked, this system was running the free (for non-business use) version, so I just uninstalled it. Next step, remove users' local admin rights!!!

_________________
Server Info: running on a CentOS 7 vm
OA Version: 2.0.6 @ 500 devices


Top
 Profile  
Reply with quote  
 Post subject: Re: Teamviewer
PostPosted: Sat Apr 09, 2016 1:23 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1226
:D
shanimal wrote:
Where is the license detail in these screenshots?
If anyone knows and TeamViewer has it in the registry somewhere we can audit it. Guess we'll have to wait for a paid TeamViewer user to chime in.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group