Preventing security breaches in the new normal of remote work

The world has been rapidly moving more online because of the ongoing COVID-19 pandemic. This has had ramifications for businesses, especially in the area of security. The reality is that there is a crucial security gap in the burgeoning video conferencing space due to the new realities of remote work. A company named StrikeForce Technologies has recently developed a solution for bridging this crucial gap in enterprise security: the gap between remote employees using Zoom and similar video conferencing technologies to perform their work from home. To find out more, I talked with George Waller, executive vice president and co-founder of StrikeForce Technologies about their new PrivacyLok platform.

MITCH: What are some of the different ways that threat actors have tried to breach security or disrupt remote work during these difficult times?

It seems like every day, we hear about a new “Zoombombing” attack where an uninvited guest finds their way into a Zoom meeting with the goal of disrupting the chat. While these types of attacks can often be vile, the reality is “Zoombombs” are just the tip of the iceberg regarding video conferencing vulnerabilities. In fact, it got to a point where last year, the U.S. government warned the public about the potential dangers of video conferencing. Hackers are now able to leverage nearly all of these platforms to infect a user’s system with malware.

From there, hackers have a multitude of options on what they can gain access to. It’s correct to assume that by infiltrating your system via a video conferencing platform, attackers would then be able to watch and listen to call recordings. What isn’t obvious, however, is the fact that cybercriminals can then pivot their attention to the actual mechanical computing processes. This includes access to a user’s camera, audio, microphone, keyboard strokes, and clipboard. The results of these attacks can range from hackers eavesdropping on an enterprise’s intellectual property and potentially holding it for ransom, leaking sensitive data to the public, or being able to steal credit card information from a user’s clipboard.

MITCH: I understand that your new PrivacyLok solution can thwart Zoombombs and safeguard people when they’re using video conferencing platforms. What can it protect against exactly?

While PrivacyLok itself can’t directly protect Zoombombings, it does protect users against the more malicious threats that prey on the vulnerabilities within video conferencing platforms like Zoom, Webex, and others. These services all have proven to have lax security and lack the necessary meeting attendee authentication protocols that need to be in place. While PrivacyLok can’t stop someone from finding and clicking a zoom meeting link that isn’t password-protected, it does serve as an endpoint protection system designed to prevent malicious activity once malware finds its way into a user’s computer. PrivacyLok stops keyloggers from stealing usernames, passwords, or other confidential and personal information as users type while locking down a user’s device to block hackers from taking control over a device’s camera, microphone, speakers, and clipboard.

However, indirectly PrivacyLok can help prevent Zoombombings in the following ways: if you have a keylogger on your system, the hacker can keylog your zoom portal login credentials, and once they log into your zoom portal, they can copy all your meetings links, contacts, email addresses, etc. Additionally, if they have a screenscraper on your computer, they can get the zoom link and login with that link because zoom doesn’t authenticate end-users. PrivacyLok prevents both of those cases from occurring.

MITCH: Let’s look at each protection feature separately. How does PrivacyLok prevent malicious actors from taking control of my laptop’s camera during a Zoom session? What about the microphone in my laptop? How does PrivacyLok keep that from being taken over?

Most people don’t realize that malware actually has the ability to manipulate the electrical inputs to many of the components and accessories included within a system. In turn, this lets hackers switch on an unsuspecting user’s camera and microphone, allowing them to see and hear everything. In fact, malicious actors can go one step further and actually manipulate the electrical functions so that a camera light won’t even turn on despite it being active. This means that anyone in the same room as the device can be watched or eavesdropped upon without them even having the slightest clue. Acting as an endpoint protection solution, PrivacyLok is able to stop a payload in its tracks once it infiltrates a system. While malware may have found an entry point, that’s all it is able to do. This solution defends against any attempts to exploit video conferencing with malware.

MITCH: I cut and paste a lot of sensitive business information when making presentations online during Microsoft Teams meetings, so I’d hate to have malware or an intruder gain access to my clipboard history. How does PrivacyLok prevent this from happening?

PrivacyLok protects the clipboard by blocking access to the clipboard for any program running in the background, which is where clipboard malware hides. On top of that, PrivacyLok is able to prevent intruders from gaining access to your keyboard strokes as well by leveraging StrikeForce’s patented GuardedID keystroke encryption software. The solution works by bypassing the vulnerable places and eliminating the possibility of keystrokes being logged. As an additional level of security, the solution encrypts all keystrokes with a military-grade 256-bit encryption code and sends out a sequence of meaningless numbers in place of your keystrokes, making any data collected by hackers completely useless.

MITCH: I also use Webex when dealing with certain clients in the financial industry. Can PrivacyLok protect me from having my username, password, or other sensitive information being stolen?

Yes, PrivacyLok is able to protect your usernames, passwords, banking information, etc., from being stolen through all of these previously mentioned ways. GuardedID helps to ensure that hackers aren’t able to access that information through your keystrokes or clipboard, while the rest of the PrivacyLok solution prevents hackers from gaining access to cameras and audio, meaning that information cannot even be stolen through active eavesdropping. This multifaceted security approach ensures users and enterprises as a whole are communicating securely and that no sensitive information is accessed or leaked.

MITCH: Being in the IT profession, I’ve learned there are no absolutes when it comes to security. As long as I want my system to be manageable and usable, I’ve accepted the reality that some malware is going to get through my existing network security controls. Can PrivacyLok help plug this gap in my defenses?

Yes, and I agree with you. The industry needs to realize that no network or device is impenetrable, and hackers are getting more sophisticated and improving their strategies every single day, meaning malware is eventually going to make its way through initial antivirus defenses. PrivacyLok was built with this reality in mind. Instead of wasting time trying to stop it from getting inside, we think a better approach is to focus on mitigating any effect a malicious payload may have on a device or network. Comparing your device to an exclusive nightclub, instead of acting as a bouncer trying to stop everyone from getting through the door, PrivacyLok acts as a moat between the door and access to anything meaningful on the inside. You might get in, but that’s it.

MITCH: Anything else I’ve forgotten to ask about PrivacyLok and remote work security that our readers will want to know about?

Yes, thanks for asking that question. StrikeForce has been developing proactive cybersecurity solutions for 20 years now. Our solutions are being used by leading companies in financial services, health care, education, government, manufacturing, and many others, and our mission is to make the world a safe place for people to compute.

Featured image: Shutterstock