Cybercriminals Hijacking Teleconferences and Online Classrooms during Coronavirus Outbreak

As the United States and other nations battle the deadly Coronavirus (COVID-19), cybercriminals are taking advantage of people working and learning from home through virtual teleconferencing (VTC) hijacking. The U.S. Federal Bureau of Investigation (FBI) has issued a warning to be hypervigilant about cybersecurity as it has received several reports of conferences being disrupted by pornographic and/or hate images as well as threatening language.The Boston Division of the FBI, which covers Maine, Massachusetts, New Hampshire, and Rhode Island, issued a warning that over the course of the last couple of weeks, two schools reported hacks into their teleconferencing and online learning environments.The first incident, reported to the FBI in late March by a Massachusetts-based high school, said school officials reported that a teacher was conducting an online class using the teleconferencing software Zoom. It was then that an unidentified individual dialed into the classroom and yelled profanity before shouting out the teacher’s home address in the middle of instruction.Another incident was reported involving a Massachusetts-based school. A Zoom meeting was underway when an unidentified individual was visible on camera displaying swastika tattoos.As businesses, schools, and individuals continue to engage in teleconferencing and online learning, the FBI and ORAM Corporate Advisors recommend taking the proper precautions and due diligence to mitigate the threat of teleconferencing hijacking. The following are some steps to reduce the risk of being hijacked:

• Keep meetings or classrooms private on Zoom and other teleconferencing software. For example, in Zoom, there are options for making a meeting private by requiring a password or using the waiting room feature so the admittance of guests can be controlled.
• Never share teleconference or classroom links and passwords on public social media. Send links and passwords directly to the people you wish to invite.
• Manage your screen-sharing options by limiting it only to the host. This can easily be done in Zoom.
• Ask users to employ the latest version of teleconferencing software and applications. Zoom updated its software in January 2020 in which it added passwords by default for meetings. Zoom also disabled the ability for people to randomly scan for meetings to join.
• Ensure your organization has a telework policy or guide to address requirements for physical and information security.

The FBI is asking victims of teleconferencing hijacking to report incidents to the FBI’s Internet Crime Complaint Center at ic3.gov. If a specific threat is issued during a teleconference, report this to tips.fbi.gov or call the Boston Division of the FBI at (857) 386-2000.Additionally, ORAM would like to also warn you to be especially vigilant with your email.  Opening links or attachments from unknown individuals could lead to a cyberattack and compromise your personal network as well as your employer’s network.If you have further questions about cybersecurity best practices while working or learning from home, contact your employer or school’s IT department or contact ORAM Corporate Advisors at (617) 933-5060.