According to US officials, China spies have been targeting Americans during the ongoing pandemic using the popular teleconferencing application, Zoom. As the lockdown caused by the coronavirus has forced millions of employees to work from home, video conferences have become the norm where teams share private company information.
However, the application has also provided a playground not just for cybercriminals, but also for spies. Zoom was previously accused of having weak security measures over allegations that it was sharing user information to third parties, and that incidents of "zoom-bombings" -- where trolls and strangers enter private video conferences -- were becoming common. The US Intelligence Officials have observed that Russia, Iran, North Korea, and China are attempting to spy on Americans using Zoom and other video chat platforms during video conferences.
Chinese spies target Americans during video conferences: Why is it not safe to use Zoom?
According to a Time report, three US counter-intelligence agencies observed that foreign spies have observing Americans through popular applications. The intelligence officials stated in the report that among the foreign cyberspies, China has been the swiftest and most aggressive.
"More than anyone else, the Chinese are interested in what American companies are doing," said one of the three US officials.
The intelligence officials and internet security researchers have been increasingly worried since the Chinese, Russians and other foreign countries are focusing on virtual tools that millions of Americans are using as they are forced to work from home. One of those has been, of course, Zoom.
According to the report of The Citizen Lab on April 3, a research organization at the University of Toronto found several security issues with the teleconferencing application. One of them makes users particularly vulnerable to China. The app's encryption keys through Chinese servers are weak and are responsive to pressure from Chinese authorities since its ownership relies on Chinese labor.
Zoom responded to address the concern with multiple public statements. After the US intelligence officials claimed that the app's platform has end-to-end encryption for all its conferences, Zoom clarified that the encryption is absent from some online messaging tools.
"While we never intended to deceive any of our customers, we recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it," said the Chief Product Officer of Zoom, Oded Gal, on his blog on April 1.
However, the investigation conducted by The Citizen Lab found other issues in Zoom's security. They found that the key for conference encryption and decryption was delivered to one of Zoom's participants located in Beijing. The investigation was able to locate five servers in China and 68 in the United States that have the Zoom server software, which is the same that the Beijing server has.
The US intelligence officials, who requested anonymity, clarified that no evidence has yet been found to show that Zoom is cooperating with China.
