UPDATE ISP TalkTalk Blocks Teamviewer VPN Service Over Scammer Fears

In an surprise development broadband ISP TalkTalk has taken the decision to block the popular TeamViewer service from their UK network, which means that anybody wanting to use the Virtual Private Network (VPN) service will find themselves unable to connect.

At this point we should be clear that TeamViewer itself is a perfectly legitimate application. I often use it myself for helping to solve technical problems with computers belonging to friends or family (one of them is also a TalkTalk subscriber). This is partly because it makes remote desktop access a lot easier to setup, although such features are by no means unique to TeamViewer.

However even legitimate Internet applications can be abused and it’s well known that fraudsters, such as those in India who recently stole personal customer details from TalkTalk and used those to run a call centre scam (here), can also make use of such tools in order to defraud consumers. Generally if a so-called support agent asks you to install TeamViewer on your computer then that should be considered a red flag to hang-up.

Never the less this is not directly TeamViewer’s fault, although there’s certainly an argument that the company could perhaps do more to tackle those who abuse their service. In reality this is no easy task because such connections are often encrypted, which would make it very difficult for admins to police. Broadband ISPs often face a similar problem when attempting to stop crafty criminals on their own networks.

Despite this The Register are reporting that TalkTalk has now blocked TeamViewer and a number of other unspecified Internet services from use on their network, which is something that the ISP’s own subscribers are currently complaining about (here).

TalkTalk Customer old_nic said:

“Teamviewer has stopped working. I am unable to ping any of their servers from Talktalk (e.g. 178.77.120.6 up to 178.77.120.100). The servers are not down, and the problem does not exist via other ISPs. Lots of other Talktalk customers are reporting the same problem for several hours (look at the websites checking whether servers are up).”

TalkTalk Customer Ant1234 said:

“They keep telling me to reboot my router or can’t help me because I don’t have a TalkTalk router. I have given them the TeamViewer address range to unblock, fingers crossed the message reaches someone inside talktalk that knows what a IP subnet is!

Was probably blocked due to the recent TalkTalk TeamViewer scam, which was a result of TalkTalk being hacked and losing client records.”

TalkTalk Customer Colin956 said:

“Wasted most of this morning trying to fix this, 3 computers not connecting to teamviewer via TalkTalk “SuperRouter” – tried to connect by tethering my computer to iphone 4g – connected to teamviewer straight away. Back to router lost connection. Loads of reports on the internet about no connection via TalkTalk – why are they blocking it?”

TalkTalk Customer jimilawson said:

“Just spent an hour online with Tech Support which resulted in: ‘Actually, this is a known issue and TalkTalk is already aware of it and already fixing the issue as we speak.’ and ‘As of now, the engineers haven’t mentioned any time frame for this. We were advised to let you know to check it again after 24 hours.'”

A member of TalkTalk’s support team has since apologised for the confusion and confirmed that “we have implemented a number of network changes that have blocked a number of applications including Teamviewer.”

The ISP added that they were “working with teamviewer and other 3rd parties” on implementing some additional “security measures” that aim to enhance the security to all customers of these services.

However TalkTalk added that it would “continue to block any sites/applications reported by customers to reduce the opportunity for fraud to take place.”

A TalkTalk Spokesperson said:

“We constantly monitor for potentially malicious internet traffic, so that we can protect our customers from phishing and scamming activities.

As part of this work, we have recently blocked a number of sites and applications from our network, and we’re working hard to minimise the impact on our customers.

We would also urge our customers to visit our Beat the Scammers website to find out more about how they can keep themselves safe online.”

The move may also put TalkTalk into conflict with the EU’s new Net Neutrality safeguards, which are largely adopted in the United Kingdom through the Broadband Stakeholders Group and its voluntary 2016 Open Internet Code. Broadly speaking the aim of this code is to ensure that consumers receive full provision of open Internet access (e.g. no blocking of legal online services).

However the Net Neutrality rules do include a caveat, which gives broadband ISPs and mobile operators some flexibility to tackle threats to the security of their networks. No doubt there is some debate to be had about whether or not it’s right that this should be applied to a legal and widely used service like TeamViewer. Why not block email too? Tons of scammers use that as well.

Hopefully TalkTalk will be able to find a longer term solution to this and ideally one that doesn’t involve blocking the entire service, which may also give TeamViewer’s competitors an advantage (this aspect may also come into conflict with the Net Neutrality guidelines). Lest we forget that this might not be such a big issue if TalkTalk’s lax security hadn’t enabled the exposure of customer details in the first place.

We’d also quite like to know what other “applications” TalkTalk has added to their block list.

UPDATE:

Curiously customers are just now reporting that TeamViewer is working again, although at this time we don’t know if that’s due to a change made by the service or a sudden u-turn from TalkTalk following the earlier reaction.

UPDATE2:

Now TeamViewer has issued the following statement.

TeamViewer Statement

TalkTalk, a provider of telecoms and broadband solutions, responded to ongoing scam campaigns aiming at unsuspecting TalkTalk customers by bringing about extended traffic filtering in the United Kingdom. This step impairs the operation of various software products. Cyber criminals abuse legitimate software to rip off their unsuspecting victims.

The measures deployed by TalkTalk may affect the use of the popular remote support software TeamViewer®. TeamViewer and TalkTalk are in a close and constructive exchange to address this issue. TeamViewer denounces criminal activities in any form.

In the context of the current situations TeamViewer stresses:

* Scams aiming at unsuspecting individuals are despicable. Yet – as a BBC-article suggests – what makes the current frauds particularly hideous is the fact that scammers are using TalkTalk customer data. Several news outlets including tripwire reported that TalkTalk experienced a data leak. The criminals apparently obtained this data and are now using it in their scam-scenarios. This provides them credibility and facilitates their cunning schemes. The fact remains, however, that large organizations would never cold call individuals to offer help with some unfounded issues. Users are strongly advised to apply extra care and a healthy dosage of scepticism with unsolicited calls.

* The current impairments are not a sign of operational dysfunctions or a security issues at TeamViewer. It is a drastic measure brought about by TalkTalk. The filter affects several organizations.

* TeamViewer and TalkTalk are in extensive talks to find a comprehensive joint solution to better address this scamming issue.