Open-AudIT
https://www.open-audit.org/phpBB3/

Teamviewer
https://www.open-audit.org/phpBB3/viewtopic.php?f=20&t=6515
Page 1 of 1

Author:  vanderheyde [ Sat Feb 20, 2016 2:07 am ]
Post subject:  Teamviewer

I just found an old topic (viewtopic.php?f=20&t=6033&hilit=teamviewer) about teamviewer.

Is this still included in the current version? I'm at v1.8.4, but I can't seem to find the items. The computers have teamviewer v8 installed.

thanks

Author:  jpa [ Sat Feb 20, 2016 6:55 am ]
Post subject:  Re: Teamviewer

audit_windows.vbs has a section for auditing the license key for TeamViewer 6 through 8. Search for "TeamViewer 8" in audit_windows.vbs to see what it does.

I don't use TeamViewer so I can't test. You could post (or PM) the registry key info it audits (removing anything that should be secret): HKLM\Software\TeamViewer\Version8 or HKLM\Software\Wow6432Node\TeamViewer\Version8.

Author:  vanderheyde [ Sat Feb 20, 2016 7:46 pm ]
Post subject:  Re: Teamviewer

Thanks for the reply, but it doesn't seem to be working.

I've ran the audit_windows.vbs, but the xml results only contained references to the service and .exe as installed software. The ID wasn't in the result.

However, the registry key you mentioned ( HKLM\Software\Wow6432Node\Teamviewer\version8) is the correct location.


On a sidenote these are the locations for v9 & v10:
v9:
HKEY_LOCAL_MACHINE\SOFTWARE\TeamViewer\Version9
v10:
HKEY_LOCAL_MACHINE\SOFTWARE\TeamViewer\

Author:  jpa [ Sun Feb 21, 2016 4:03 am ]
Post subject:  Re: Teamviewer

I understand that it's not working but can't do anything to help you as I don't have TeamViewer. The audit code is open in audit_windows.vbs. Step through the code and your registry keys to see why it is failing.

Author:  Mark [ Mon Feb 22, 2016 9:45 am ]
Post subject:  Re: Teamviewer

+1 what JPA said. I don't have TeamViewer either so I'm of no use.

Author:  shanimal [ Thu Apr 07, 2016 12:20 am ]
Post subject:  Re: Teamviewer

Just checked in our OA system, found 1 computer with "TeamViewer 10"!

I looked here

HKLM\Software\Wow6432Node\Teamviewer

no refs to "TeamViewer 10" (see attached TeamViewer.jpg for all details found here)

I think OA may have found "Teamviewer 10" here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TeamViewer\ (see 2nd attached JPEG TeamViewerSvc.jpg)

Attachments:
TeamViewerSvc.jpg
TeamViewerSvc.jpg [ 115.85 KiB | Viewed 3099 times ]
TeamViewer.jpg
TeamViewer.jpg [ 243 KiB | Viewed 3099 times ]

Author:  jpa [ Thu Apr 07, 2016 3:47 am ]
Post subject:  Re: Teamviewer

That is useful information but now I'm wondering what we're trying to audit. OA attempts to audit name, ClientID (key?) and release number for TeamViewer 1 through 8 but only ClientID was actually pulled from the registry. The ClientID is supposedly the TeamViewer license key which is what OA is trying to audit.

It looks like TeamViewer has changed their registry key format a bit. From your screenshot we have TeamViewer installed into the "TeamViewer 9" Start Menu group, with a Version of 10.0.47484 and an UpdateVersion of 11.0.56083 and a number in ClientID. Again, we don't use TeamViewer so I'm not sure what you would like audited. Keeping in mind this is for auditing license keys. Actually, is this supposed to be secret? Should you remove the screenshot with this info?

Given all that how should those map into Open Audit key storage of "name, string, rel, edition"?

Author:  shanimal [ Sat Apr 09, 2016 12:32 am ]
Post subject:  Re: Teamviewer

Hi jpa-

I posted the screenshots, trying to help out vanderheyde. I don't use TeamViewer either, and I'm not sure why somebody installed it on one of the vm's. I doubt the end user purchased a license. Where is the license detail in these screenshots? I guess if I can find it I could black it out and re-upload.

thanks

Author:  shanimal [ Sat Apr 09, 2016 12:41 am ]
Post subject:  Re: Teamviewer

Disregard my prev question. I checked, this system was running the free (for non-business use) version, so I just uninstalled it. Next step, remove users' local admin rights!!!

Author:  jpa [ Sat Apr 09, 2016 1:23 am ]
Post subject:  Re: Teamviewer

:D
shanimal wrote:
Where is the license detail in these screenshots?
If anyone knows and TeamViewer has it in the registry somewhere we can audit it. Guess we'll have to wait for a paid TeamViewer user to chime in.

Page 1 of 1 All times are UTC + 10 hours
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/