Simple Help attacked

[Darrell_Swafford]

@Antony

Regarding point 2, being able to deploy a script to multiple machines rather than having to take the same action 700 times is not a design flaw it is the entire point of the feature. There are permissions to disable this facility on a per-tech or per-tech group basis if you wish to make it unavailable but limiting this by number (e.g. 10 machines max at a time) won’t prevent a bad actor that has already gained access as an authorised user from carrying out the same attack on all the machines, it will just take them a little longer.

Agreed, I would hate to have this feature removed. I would have to look at another product. I do think though ( just my opinion ) there should be an additional confirmation when running tools. I have accidentally been bumped and ran the wrong tool from the list. Not a deal breaker though.

As with the technician console timeout, a limit would not prevent any attack from a security standpoint. Rather the focus has to be on preventing bad actors from gaining access as an authorised technician. We have a number of features in place such as MFA and technician client login IP restriction to ensure that tech accounts are secure from hack, but fundamentally if the technician logs in to SimpleHelp (or any other software, like Avast) from a compromised machine and then leaves the bad actor free to use it, whether by accident or intention, then any software on that machine that is already authenticated is open to abuse and there is really not anything that any of that software can do about it.

I agree with this as well but again ( just an opinion ) a configurable timeout, something that can be enabled and configured by the SimpleHelpAdmin, would help the absent minded. Though he should also have a lock screen set on his PC when away as well. That may or may not be enforceable though depending on their environment.