Intrusion Prevention
Intrusion Prevention

How to Block Teamviewer application

06.10.09   |  
‎06-10-2009 04:52 AM

Dear all

 

anyone know how to block teamviewer application on JUniper IDP ?

 

I tried to block port 5938, it was unsuccesful, when i checked teamviewer is using port 80. soi think we should create custom attack object. i tried create that but still unsuccesful. anyone help me

 

 

Thanks

 

Elkim
9 REPLIES
Intrusion Prevention

Re: How to Block Teamviewer application

06.10.09   |  
‎06-10-2009 05:20 PM

Hi,

 

 I found a Team Viewer post below.  Have a look at the predefined attack "Info - SPYWARE:RAT:TEAMVIEW-HTTP-CLNT".  Let me know how you make out.

 

https://services.netscreen.com/restricted/sigupdates/nsm-updates/1090.html#7866

 

-John

John Judge
JNCIS-SEC, JNCIS-ENT,

If this solves your problem, please mark this post as "Accepted Solution". Kudos are appreciated.
Intrusion Prevention

Re: How to Block Teamviewer application

06.10.09   |  
‎06-10-2009 08:02 PM

hi ,

 

I already use that signature but useless

 

 

Thanks

Intrusion Prevention

Re: How to Block Teamviewer application

06.10.09   |  
‎06-10-2009 08:27 PM

Hi,

 

I think you may need to then capture the authentication packets and create a custom signature.  Either that or open up a ticket with JTAC.  They may be able to provide you with a sanity check on the predefined object and your policy.

 

-John

John Judge
JNCIS-SEC, JNCIS-ENT,

If this solves your problem, please mark this post as "Accepted Solution". Kudos are appreciated.
Intrusion Prevention

Re: How to Block Teamviewer application

06.10.09   |  
‎06-10-2009 08:34 PM

Yes, thanks for update., i already arise this issue to signature team and contact him to help create custom signature to block teamviewer application

 

 

thanks

 

Indra ELkim

Intrusion Prevention

Re: How to Block Teamviewer application

12.07.10   |  
‎12-07-2010 07:30 AM

İcan do the solitions.

İS There any grafical solitions .

thansk

Best Regard,
___________________________
www.galatasaray.org
Intrusion Prevention

Re: How to Block Teamviewer application

01.28.11   |  
‎01-28-2011 11:23 AM

The attack object "REMOTE-ACCESS:TEAMVIEWER-HTTP" was released June 17, 2010 and was tested to block the TeamViewer application at that time.

 

You might want to give that a try.

Intrusion Prevention

Re: How to Block Teamviewer application

02.18.11   |  
‎02-18-2011 04:04 AM

Hi ,

Can you share the solitions ? I have to try the solitions on SSG320M

Best Regard,
___________________________
www.galatasaray.org
Intrusion Prevention

Re: How to Block Teamviewer application

03.30.12   |  
‎03-30-2012 08:43 AM

define custom  deep inspection

cs:teamviewer signature http:-url-parsed info /d(in|out)\.aspx

Highlighted
Intrusion Prevention

Re: How to Block Teamviewer application

07.15.12   |  
‎07-15-2012 10:51 PM

Hi

 

I also using the custom signature but unable to block the team viewer connections.

Please help....