How not to get ‘rick-rolled’ on Zoom

With millions of Americans driven indoors by the novel coronavirus, they’re turning in big numbers to teleconferencing and video-chat platforms to host happy hours with friends, both teach and attend classes, and conduct business meetings.

Zoom has emerged as one of the most dominant platforms. Before the outbreak, the video conference application mostly was used it for virtual work meetings and presentations.

But as the home-bound have sought ways to stay connected with friends and family, Zoom has grown from a peak of 10 million users in a single day last year to more than 200 million daily users in March, the company wrote in a recent blog post.

The crush of new users, however, has exposed some of Zoom’s security vulnerabilities — one of which allowed hackers to gain access to a user’s microphone or webcam.

The company’s “end to end” encryption also was deemed insecure, potentially exposing users’ communications to Zoom employees.

Other design flaws created an opening for “zoombombing”, where unwanted guests invade a video meeting with memes or vulgar disruptions.

“Because of the way (Zoom) generates conference IDs for conferences on the free accounts, it was easy to join and automatically jump in,” said Bret Piatt, CEO of the San Antonio cybersecurity firm Jungle Disk. “It’s the Zoom equivalent of prank calling someone. You jump into that meeting and you might rick-roll someone, or do something more offensive. That was a lot of what was happening with Zoom.”

Rick-rolling is when hackers infiltrate Zoom meetings with a meme from the music video for singer Rick Astley’s 1987 song Never Gonna Give You Up — which is a show stopper.

Zoom executives have publicly apologised for the app’s security flaws, and the company since has said it’s directing more resources to strengthening security.

Zoom now requires users to enter a digital “lobby” before being admitted to a meeting to keep out uninvited guests. Users also can require passwords for their sessions.

“We did not design the product with the foresight that, in a matter of weeks, every person in the world would suddenly be working, studying and socialising from home,” Zoom founder Eric Yuan said earlier this month in a blog post. “However, we recognise that we have fallen short of the community’s — and our own — privacy and security expectations.”

Several governments and large organisations have banned the use of Zoom altogether. Google doesn’t allow its employees to access the application on work computers, and the New York public school system outlawed Zoom for remote teaching.

The US Senate also recently told members to avoid using Zoom while working remotely because of security problems.

So, does this all mean you should never use Zoom ever again?

“The general usage of Zoom I think is fine at this point — I use it for meetings personally,” Piatt said.

The question is: How important is your meeting?

“If you and your friends are going to get together on a Friday evening, or you’re going to get together and have brunch on Easter Sunday, would you care if you’re at a restaurant and people overheard your conversation? Probably not,” Piatt said. “So you’ve got to think about it from that perspective.”

“SpaceX banned Zoom,” he added. “They’re very restrictive on a lot of their technology because they have supervaluable intellectual property on how to build and launch and land rockets from space.”

For Zoom users trying to keep in touch with relatives or friends, they likely don’t have much to worry about. But even for casual users, Piatt recommended making sure the Zoom app is closed and not running in the background when they’re not using it.

If you are concerned about using Zoom for personal conversations, though, both Skype and Google’s Duo video-conferencing application are similar to Zoom, but without the same security concerns, Piatt said.

iPhone users can hold video-chat groups with up to 32 participants using the FaceTime app, though friends who have Android phones will be left out.

Houseparty, another video communication platform, allows up to eight users to talk and play games. The app is available for both Mac and Android users.

It’s a different story for small business owners.

Piatt said he recommends all small businesses use a paid version for video conferencing apps. Zoom’s businesses plans are priced between US$15 (RM65) and US$20 (RM86) per month, for example.

“Say you’re running an engineering firm that works on commercial building systems,” Piatt said. “If hackers were to get in and overhear what’s going on, would your customer be upset? Am I legally required to keep things confidential? These are the kinds of questions to think through.”

Google Meet and Microsoft Teams are the other business-level equivalents to Zoom. Piatt uses all three platforms.

“With the changes they’ve made at Zoom, at this point it’s comparable to the Google and Microsoft solutions for a general business that doesn’t have to be concerned about a nation-state-level cyber risk,” he said.

As business owners and the public increasingly rely on teleconference platforms, Piatt said they should practice cybersecurity common sense. That doesn’t mean you need to immediately delete that Zoom app from your device, though.

“It’s an area where you should be thoughtful and have an extra level of diligence,” Piatt said. — The San Antonio Express-News/Tribune News Service

Source: TheStar