AnyDesk resets passwords after breach

Remote access company AnyDesk has disclosed a breach of its systems and reset users’ passwords, with some user credentials allegedly leaked on dark web sites.

In a notice, the company also said it is revoking the code signing certificate used to sign its binaries, and will be issuing a new one.

This indicates that some source code may have been exfiltrated in the attack.

The password reset affects users of the company’s web portal, my.anydesk.com, and the company says users should reset passwords on any services they used the same credentials on.

AnyDesk said it took the action “following indications of an incident on some of our systems,” and that “a security audit … found evidence of compromised production systems.”

The organisation has notified authorities in the US and has called in CrowdStrike to help.

Resecurity said that on February 3, it “identified multiple threat actors selling access to compromised AnyDesk credentials on cybercriminal forums”, including one listing claiming to have 18,000 credentials for sale.

Resecurity noted that accounts listed for sale did not have MFA enabled.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts