Top Seven Security Tips For Working from Home - Top Tip #5
Don’t Share Confidential Information Over Zoom
The popularity of applications like Zoom and House Party has exploded in recent weeks, however, there are concerns with the security of some applications.
“The decision to use Zoom, as millions of others stuck at home during the coronavirus outbreak are doing, comes as concerns are growing about the conferencing app's business model and security practices. Most notably, the company has been forced to admit that although it explicitly gives users the option to hold an “end-to-end encrypted” conversation and touts end-to-end encryption as a key feature of its service, in fact it offers no such thing. Specifically, it uses TLS, which underpins HTTPS website connections and is significantly better than nothing. But it most definitely is not end-to-end encryption (E2E). E2E ensures all communications are encrypted between devices so that not even the organization hosting the service has access to the contents of the connection. With TLS, Zoom can intercept and decrypt video chats and other data.” - The Register
It is thus advised to treat any confidential conversations held over Zoom as being vulnerable to being overheard. Of course, the other issue is that unlike face-to-face conversations in an office environment, you have to assume all online conversations are being recorded.
‘Zoom bombing’ on the rise
On 30 March, the FBI announced it was investigating increased cases of video hijacking, also known as “Zoom-bombing”, in which hackers infiltrate video meetings, often shouting racial slurs or threats.
Zoom meetings can be accessed by a short number-based URL, which can easily be generated and guessed by hackers, a January report from the security firm Checkpoint found. A number of security flaws affecting Zoom have been reported in the past and as recently as this week. In 2019, it was revealed Zoom had quietly installed a hidden web server on user devices that could allow the user to be added to a call without their permission.