[Update] Incident affecting AnyDesk solutions (February 5, 2024)

A data leak at AnyDesk Software GmbH on January 29, 2024, involved the potential theft of source code, private certificates, and keys from the publisher, as well as the compromise of two European relay servers. The leaked data may be used in subsequent attacks targeting users of AnyDesk solutions, potentially aiming to weaken communication infrastructure via Man-in-the-Middle attacks or alter the published software. AnyDesk provides remote assistance and access solutions for various operating systems including Windows, Linux, MacOS, Android, and iOS.
The incident prompted CERT-FR to recommend immediate preservation measures, including inventorying all installed AnyDesk solutions, assessing their usage context, and conducting a digital investigation on affected machines. For systems lacking security updates, uninstallation or updating is advised, and specific application binaries are identified for monitoring. Users are also instructed to renew associated passwords and search for suspicious activity dating back to December 20, 2023.

* A data leak occurred at AnyDesk Software GmbH on January 29, 2024.
* Stolen data may include source code, private certificates, and keys from the publisher.
* Two relay servers in Europe were also affected by the incident.
* The leaked data could potentially be reused to target users of AnyDesk solutions.
* Potential attack aims include weakening communication infrastructure (e.g., Man-in-the-Middle attacks) or altering company software.
* Affected systems include all software produced by AnyDesk for Windows, Linux, MacOS, Android, iOS, AppleTV, and On-Premises environments.
* Specific affected versions are those signed prior to certain version numbers (e.g., Windows prior to 8.0.8).
* Preservation measures involve inventorying installations, assessing machine sensitivity, and sequestering digital investigation reports on affected machines.
* Affected Windows signing fingerprint is 9cd1ddb78ed05282353b20cdfe8fa0a4fb6c1ece.
* Affected MacOS signing fingerprint is 4a1dfb9aa37809b3a123e0ac750bf370469ebaeb.

The situation reveals a critical nexus between proprietary software distribution and security, where the compromise of application assets directly translates into potential risk for end-users operating those tools across diverse environments. The attack vector—stolen credentials/code used to facilitate further infrastructure attacks—suggests an intent not merely to steal data but to weaponize the access capabilities inherent in remote desktop solutions against their users' security perimeters. The subsequent recommendations emphasize a layered defense: immediate forensic preparation combined with proactive remediation steps like patching and certificate verification.
The pattern here is one of exploiting trust embedded within necessary operational software. The entity faces the challenge of balancing the necessity of using these tools for remote work or administration against the inherent risk introduced by their architecture and supply chain. For any organization relying on such systems, the real implication is a mandate for radical transparency regarding system inventory and behavior, moving beyond simple compliance checks to deeply assess the operational context of software deployment. The focus shifts from merely patching vulnerabilities to restructuring trust models within the technological stack.
Bridge Questions: How can organizations create verifiable trust boundaries around software supply chains when the source code itself is a potential attack vector? What mechanisms exist for mandating and continuously auditing the integrity of remote access software used in critical infrastructure environments? What are the long-term consequences of relying on commercially available tools where core security controls are dependent on external entities?