The ongoing lockdown had forced the several people all over the world has forced to connect through the video call apps to stay connected. Zoom has rapidly become one of the most essential apps as people adapt to remote working. It was reported that over 500 thousand Zoom accounts were sold on the dark web, which is available for a penny. Now, as the platform is not safe, as per the Ministry of Home Affairs has raised alarm bells, and said is unsafe and vulnerable to cyber-crimes.
The ministry’s notification comes at a time when the platform has gained prominence with most industries now working from home in the wake of the covid-19 outbreak, globally. At the same time, with privacy coming into question in case of Zoom, the Centre has also asked all its ministers and staff to refrain from conducting any meetings on third party applications.
The MHA in its latest advisory through its Cyber Coordination Centre (CyCord) on Thursday has red-flagged the video conferencing facility as “unsafe”, days after India’s Computer Emergency Response Team (CERT-IN) had raised concerns over potential cyber attacks through Zoom. In an order issued earlier on 30 March, CERT-IN said the application was vulnerable to cyber attacks, including leakage of sensitive information.
- Zoom has seen a surge in use around the world amid coronavirus lockdown
- It claims to use end-to-end encryption in its marketing and official documents
- The definition of end-to-end encryption differs from industry standard
- Instead it uses a less secure process which is equivalent to HTTPS used online
- This offers some protection but allows Zoom to access private chat records
The agency had pointed out that the app has significant weaknesses. “Zoom is a not a safe platform,” the Cyber Coordination Centre (CyCord) of ministry of home affairs said in a new 16-page advisory. Ministry of Home Affairs has warned the Zoom app users that the video-conferencing application is not safe. An expert says, China is trying to understand our business model by zoom
Online communication platforms such as Zoom, Microsoft Teams, TeamViewer and Teams for Education, Slack, Cisco WebEx etc are being used for remote meetings and webinars. Insecure usage of the platform may allow cyber criminals to access sensitive information such as meeting details and conversations, it added.
In case of Zoom, a Motherboard analysis revealed that its iOS app sends data to social networking website Facebook even if a user doesn’t have an account on it. In fact, a user has filed a suit against the company, alleging that the app “collects information of its users and discloses, without adequate notice or authorisation, this personal information to third parties, including Facebook, invading the privacy of millions of users”.
Both CERT-IN and the Union home ministry have now suggested as part of the directive that users and organisations need to keep the software up to date and ensure that the password for each meeting should be changed and reset.
At the same time, it also suggested the host of the meeting to “end meeting” after the conference was over instead of “leaving” it, adding that “these suggestions are especially important for those meetings in which sensitive details are discussed.”
In a set of guidelines, the CCC division of the MHA mentioned that “those private individuals who still would like to use Zoom for private purposes” should follow certain guidelines like prevention of unauthorized entry in the conference room and unauthorized participants to carry out the malicious activity on terminals of others in the conference. The advisory also suggested to “avoid ‘DOS’ attacks by restricting users through passwords and access grant.”
However, in response, Zoom stated that it takes user security extremely seriously. “A large number of global institutions ranging from the world’s largest financial services companies and telecommunications providers, to non-governmental organisations and government agencies, have done exhaustive security reviews of our user, network and datacenter layers and continue to use Zoom for most or all of their unified communications needs,” a Zoom spokesperson said.
The home ministry also said these safety practices would prevent unauthorised entry into the meeting rooms, as well as thwart “DOS (denial of service) attacks and prevent authorised people to carry out malicious tasks within various conferences.”
In the meantime, the government on 13 April also issued an advisory to all central government officers cautioning them against using third-party software and apps.
When Google and Facebook listen to your conversation even when your phone is idle, what could be worse than this. The issue with Zoom is It lacks end to end encryption. Hence, the performance and experience is much better and they have very wider use. Another expert says, we should be using multiple platforms (for online collaboration) to keep our data spread not restricted to a single provider. Sometimes Teams, sometimes Skype and sometime Zoom. As such all cloud data is not safe… Someone told, with Corona and we staying at home, we can read the data in the cloud very clearly now !!!