Alongside the OS-native remote-access protocols, organizations and individuals run third-party remote-desktop products, TeamViewer, AnyDesk, Chrome Remote Desktop, Splashtop, LogMeIn, and others, that provide remote control through the vendor's own client, often via a cloud relay that works through NAT and firewalls. That design shifts the attack surface: access is keyed on a device ID plus a password, account assignment, or an unattended-access policy; clients normally initiate outbound connections to vendor infrastructure; and product-specific vulnerabilities affect particular versions. The surface includes access-control configuration, weak or exposed credentials, relay reachability, and named product advisories.
# endpoint inventory is authoritative; relay traffic is normally outbound
tasklist | findstr /i 'teamviewer anydesk splashtop logmein'
netstat -ano | findstr /r ":5938 :6568 :443 :80"
Subtopics#
- Enumeration: detecting the product and version.
- Authentication: ID-based access, unattended access, and weak passwords.
- Exposure: external reachability and incoming-session configuration.
- Known product issues: version-specific advisories and documented security incidents.