Tele-Hacking: Video Conference Hijacking and Steps You Can Take To Mitigate The Risk and Respond

The world’s shift to video-teleconferencing (VTC) in the wake of COVID-19 has presented an opportunity for sophisticated hackers to infiltrate digital meetings and access confidential and proprietary information. This expanding threat has important implications for everyone in the public and private sectors using any VTC platform. 

Privacy and security issues in VTCs may pose immediate business, economic, and national security risks. For example, reports suggest a world leader shared screenshots of national security issues during a VTC, raising concerns that national secrets may be compromised. For the private sector, the risks could also be significant. A tele-hacker could obtain access to and trade on inside information, steal trade secrets, or publicly disseminate sensitive and confidential information (or hold that information hostage for a sizeable ransom). To protect against these threats, public and private sector actors should revisit their cybersecurity policies, coordinate with VTC vendors, and ensure a mitigation plan is in place.

For businesses making such services available, redoubling cybersecurity and compliance efforts, and communicating best practices to customers, and users alike, is critical.

Law enforcement is also monitoring these trends. The Federal Bureau of Investigation (FBI) recently released guidance specific to mitigating the risk of tele-hacking with VTC, which businesses may use to benchmark their efforts:

• Make meetings private by requiring a password or controlling the admittance of guests.
• Limit distribution of teleconference links.
• Limit screen sharing to “Host Only” to prevent people and unintended participants from taking over and sharing images or content that is inappropriate or alarming.
• Constantly monitor for software updates.
• When selecting a VTC vendor, consider what security measures those vendors offer, such as end-to-end encryption.

If you believe you are a victim of a tele-hack, it is important to execute your incident response plan and consult technical and legal professionals to help with remediation and analyzing any disclosure obligations to the government, customers, or others.