GoToMyPC Remote Access Hit By Hackers

Users of remote access tool GoToMyPC will need to reset their passwords as a security measure after an attack by hackers. Although creators Citrix describe it as a "very sophisticated" attack, it's simply another case of hackers targeting people who continue to re-use passwords on multiple sites.

GoToMyPC is a tool that lets users remotely access their PC or Mac using another computer or mobile device. As with most such tools, the computer being remotely accessed must be switched on and connected to the Internet.

The actual system that powers GoToMyPC, and its database of login details has not been breached. Instead, Citrix has confirmed the attackers are simply trying out username and password combinations that appear on leaked data from other sites. While Citrix didn't name those sites, databases from several high profile sites have been made public in recent weeks, with most notably being LinkedIn.

Users Must Reset Passwords

Citrix responded to the attacks by making it mandatory for all users to reset their passwords for GoToMyPC before accessing their account again. Once a user goes to login, they'll get an email message which contains a link to reset the password.

According to Citrix, none of its other services are affected and passwords remain unchanged for those tools.

When setting up a new password, Citrix recommends using at least eight characters with a mixture of numbers, upper and lower case letters, punctuation and symbols, and avoiding words which appear in dictionaries. (Source: gotomypc.com)

Second Remote Access Tool Hit By Attackers

While it's always a good idea to use different passwords for different sites, it's particularly important to do so for sites which allow access to confidential data or remote access to a computer, which could in turn give an attacker the ability to read, modify or delete data, or even drain financial accounts linked to the web, such as PayPal. (Source: bbc.co.uk)

This is a separate incident to the recent spate of attacks on TeamViewer, another remote access tool. In that case, while the company itself was adamant that reused passwords were to blame, some users said this was not the case and/or that the tool's optional two-factor authentication had not prevented the attack.

What's Your Opinion?

Are you a GoToMyPC user? Is the company right to require a mandatory password reset even if that means some inconvenience for users? What more can companies do to discourage people from reusing passwords across different sites?