QUANTICO, Virginia -- During the COVID-19 pandemic, more people have turned to video-teleconferencing to stay in touch with loved ones, collaborate with coworkers and even attend medical appointments.
The increase in video-conferencing browsing trends has garnered the attention of hackers who are looking for innovative ways to infiltrate computer software systems.
“Cybercriminals are conducting sophisticated phishing campaigns and exploiting vulnerabilities within various video-teleconferencing platforms to steal sensitive data,” said Edward Labarge, director, Major Cybercrime Unit. “A lot of this stolen data is already being sold on the dark web. This highlights the importance of using only the approved Department of Defense software, tools and platforms for official government business.”
The use of collaboration tools enhances the military’s mission attainment and day-to-day business process capabilities. However, the use of unauthorized collaboration tools on Government Furnished Equipment, or GFE, has the potential to expose critical information or introduce vulnerabilities. Commands should remind personnel that the use of unauthorized commercial collaboration tools or using commercial email for official business could be a violation of Army policy.
“Official business should only be done on Government Furnished Equipment,” Labarge said. “Even though many of us are working from home, that doesn't mean our duties to protect information stops. Emails containing sensitive data must be encrypted and we should never use personal email for official business.”
Labarge said cybercriminals are able to exploit VTC software -- whether it’s a paid service or free -- to obtain sensitive information or even eavesdrop on conference calls and virtual meetings. To gain access, cybercriminals may employ phishing, spoofed links or mobile applications that appear to come from legitimate VTC vendors.
CID officials also stated some VTC software companies may not have the user’s best interest in mind. One well-known VTC company is currently being sued for allegedly selling user data to third parties, including a popular social media company. According to the lawsuit, a VTC company has provided the third-party with customer information, including details of the device used.
“Like all online accounts, it's important to use complex passwords coupled with two-factor authentication,” Labarge said. “The majority of online platforms offer two-factor authentication in the form of SMS text messages or even through the use of an Authenticator App. Additionally, it's important to never use the same password for all your accounts.”
As always, you should apply cyber best practices and weigh associated risks to ensure privacy and protect critical information. Consider the following steps:
• Verify the link to the meeting you attend is legitimate.
• Make sure to download the VTC software from the correct website.
• Verify the meeting ID and dial-in information is legitimate.
• Do not make meetings public.
• Do not share a link to a teleconference in an unrestricted, publicly available social media post. Provide the link directly to specific people.
• Avoid remote desktop sharing.
Below is a list of approved collaboration software for military personnel to use for official telework purposes. Contact a system administrator for additional guidance on approved VTC software.
• DISA Global Video Service (GVS)
• Defense Collaboration Services (DCS)
• Skype for Business
• Intelink
• milSuite
• DoD Commercial Virtual Remote (CVR) Environment
According to CID officials, there is also an approved option of “Zoom for Government,” still available for DOD use with prior approval.