Archive

Posts Tagged ‘Team Viewer’

Blocking TeamViewer Connection Using Cisco ASA Firewall

January 13, 2011 3 comments

TeamViewer (TV) is application that used to create remote access connection to PC anywhere. Even if the PC located behind the firewall.

Similiar like YahooMessenger, TV provide every client with the PIN and password. Everyone who want to access the other TV client need to know the PIN and password of the opposite PC. And every party that want to make connection must be connected to the TV server (servers domain is *.teamviewer.com and/or *.dyngate.com) usualy using TCP port 80.

PC that running TV is potentialy act as a backdoor in the enterprise network. Yes, to make remote connection we need to know the PIN and password, but using Social Engineering technique, untrusted person can gained it.

Because TV client using port 80 for the outbound connection, it is difficult to block using port basis. So, because TV client must be connected first to the TV server, we can use another aproach, that is blocking every dns request for the *.teamviewer.com and/or *.dyngate.com

So, these are the configuration if we use Cisco ASA Firewall (i am using OS ver 8.x):

regex TV-RGX “\.teamviewer\.com”
regex DG-RGX “\.dyngate\.com”

class-map type regex match-any TV-CLS
match regex DG-RGX
match regex TV-RGX

policy-map type inspect dns TV-PLC
parameters
message-length maximum 512
match domain-name regex class TV-CLS
drop

policy-map global_policy
class inspection_default
inspect dns TV-PLC

service-policy global_policy global