I’m Controlling Your Cursor

Today in Tedium: It’s not every day that I get to tell a story about a type of technology that was recently in the news for macabre reasons, but then again, it’s not often that water supplies get hacked using screen sharing technology, which is something that literally happened last week in Florida. At the center of the debate is a tool that is perhaps at the peak of its cultural importance, but that naturally comes with inherent security concerns: The remote viewer application, which is incredibly useful when, y’know, people are remote, as is quite common right now. But it comes with complications, as seen in a certain community’s water treatment system. Today’s Tedium discusses the history of remote viewers, which go back further than you might guess. — Ernie @ Tedium

Today’s Tedium is sponsored by Morning Brew, an awesome newsletter you should check out.

“After I dial in and connect to your computer, I can do whatever I want! Wonder if I should try the ‘format c:’ command? Whoo, I’M CRAZY!”

No Windows, no problem: Remote access software dates back to the DOS days

Remote access has been a theme of computer software for decades—all the way back from the early days when people would access mainframe networks on dumb terminals. But the idea of connecting to a computer as if it’s in the room and having full access to it still feels a bit like magic to some users, despite the fact that we’ve been doing it for decades.

A key tool in the history of remote access software is Carbon Copy, an offering that allowed users to access remote computers from a distance and control them as if they were in the room. First offered in the mid-1980s, the software, initially produced by Meridian Technologies, used a trick to stay resident in memory in DOS, allowing remote users to call in and manage a computer over the phone line.

This was an impressive trick for its time, and a somewhat obscure one—a 1986 PC Magazine profile called the product category “new enough to qualify as a secret for most PC users.”

An ad for Carbon Copy Plus that promoted the fact you could work with two computers with just a single copy of the software. Get ready to mail some floppies. (via Google Books)

Carbon Copy, which received a glowing, in-depth profile in InfoWorld the next year, was seen as an early leader in the market, with other tools such as Norton’s pcANYWHERE first emerging around the same period. In these early days before the internet was commonplace, these platforms worked over standard modems, and required people to call into the remote machine.

Ironically for a product called Carbon Copy, the tool had problems with piracy. At one point in its history, Meridian Technologies had a bounty program in which it called on software users to turn in their colleagues for using unauthorized copies of Carbon Copy, a name that literally evokes cloning things.

“We are really going as far as we can to support the product, and all we’re asking in return is that people play fair with us,” the firm’s Charles Jones told PC Magazine. “Unfortunately, the world being what it is, I fully expect we will be paying several people $2,500.”

Timbuktu Pro. (via Macintosh Garden)

The promise of having remote access to more powerful computers was extremely tantalizing, especially so when a GUI was attached. In a 1988 article in InfoWorld, the Mac-based remote access tool Timbuktu, which worked over local networks and modems alike, was sold to users as a way to use more powerful computers on more modest hardware. (No color, though; them’s the breaks.)

“For about the price of an SE, you can use a Mac II chassis,” said Reese Jones of the company Farallon, which had acquired Timbuktu maker WOS Data Systems at the time.

An example of the DOS version of pcANYWHERE being used.

Of course, this technology evolved over time and didn’t stay still; soon, tools like pcANYWHERE made the leap from DOS to Windows, and remote access tools increasingly became platform-independent, making machines easier to manage outside of the office.

The result is that remote access is a key part of the utility toolset for IT teams far and wide. But is it by no means a perfect tool.

The notorious hacking tool Back Orifice shares a lineage with modern remote desktop management software. (via F-Secure)

The problem with remote access is that it is way too easy to misuse

You probably didn’t expect this story offering the basics of Remote Desktop technology to take a detour into a popular politician’s teenage years, but that’s the timeline we live in.

And in that timeline, a couple of years ago, onetime presidential candidate Beto O’Rourke made an announcement that he was once a hacker. Kind of.

See, he was once a member of the Cult of the Dead Cow (cDc, but not like the CDC), a decades-old group known for its work in the hacking scene, though in that role O’Rourke did more creative writing than actual hacking. (I promise, that’s not a slight; cDc is a DIY media group just as much as a hacking collective.)

It should be noted that many cDc members not named Beto O’Rourke also went on to respectable careers—lead member Mudge, birth name Peiter Zatko, once worked at DARPA and is now the head of security for Twitter.

Before Beto gave it a fresh shot of mainstream attention, the group was best known for creating one of the best-remembered hacking tools of the past 30 years—Back Orifice, a remote access tool that represented a “backdoor” tool that gave users full access to a Windows user’s computer. (The name, as you may have deduced, is a dirty joke that references Microsoft.) The tool, first announced at the DEFCON event in 1998, came to life as a way to encourage Microsoft to take security more seriously.

And when Microsoft failed to take it seriously enough, they released an upgraded version that was even more sophisticated. What made the tools dangerous was not simply that they could exploit computers; what made them dangerous was that it lowered the barrier of entry for hacking to those who didn’t know what they were doing.

The strange thing is, though, when broken down, Back Orifice is not that dissimilar to more modern remote administration tools, which also offer in-depth access to end-user machines.

The difference is the context, as well as the approach to security. Today’s remote access (usually, water treatment facilities notwithstanding) is highly secure, and allows administrators to manage highly sophisticated systems remotely. Many of our machines can be managed just like the Trojan-hacked Windows 98 machines of yore. The difference is that, rather than relying on the cloak-and-dagger approach, they do it through secure means.

TeamViewer, which is a perfectly fine tool when used correctly. (via PC Magazine)

Tools such as TeamViewer are incredibly common in the information technology space as a result. But they come with challenges, especially as security modernizes.

A good example of this is actually Symantec’s pcAnywhere, which found its security turned into a joke about nine years ago, when its source code had been stolen and released on The Pirate Bay after the hacker failed to extort money out of the company. The pcAnywhere software, which dated to the mid-1980s, was soon taken off the market entirely.

Remote access is something that can be easily exploited in the wrong hands, especially with poor security protocols.

“Many businesses use remote desktop to facilitate network access for remote employees over the Internet. But by granting such access, these businesses have made it much more likely they’ll be targeted and hacked,” says Matt Ahrens, the head of the security team at the cyber insurance firm Coalition, in a 2018 post for DarkReading.

Of course, given this risk, much remote software works on strengthening the moat so the access is in limited hands. Which is why the incident at the water treatment plant in Florida is basically the perfect example of what not to do with remote desktop access.

TeamViewer with the default password? Ending use of a high-access tool without actually removing it? Absolutely not the way you’d want to manage remote software that handles something as sensitive as a community’s water supply. Which is, of course, how it was set up.