Just like their consumer counterparts, enterprise IT execs have flocked to Zoom for all manner of meetings. But security has invariably taken a backseat to convenience and availability, as anyone who has endured a Zoom intruder knows all too well.
Zoom this week (it hasn’t yet said exactly when) will roll out its upgraded encryption option. But it comes at the cost of surrendering various popular features. And it also does not come with improved authentication and identification of users, a capability Zoom now is promising to deliver sometime in 2021.
Zoom describes its current encryption offering as adequate, but not ideal:
“This current design provides confidentiality and authenticity for all Zoom data streams, but it does not provide ‘true’ end-to-end (E2E) encryption as understood by security experts, due to the lack of end-to-end key management. In the current implementation, a passive adversary who can monitor Zoom’s server infrastructure and who has access to the memory of the relevant Zoom servers may be able to defeat encryption. The adversary can observe the shared meeting key (MK), derive session keys, and decrypt all meeting data. Zoom’s current setup, as well as virtually every other cloud product, relies on securing that infrastructure in order to achieve overall security; end-to-end encryption, using keys at the endpoints only, allows us to reduce reliance on the security of Zoom infrastructure.”
The new optional approach slated to start this week is tagged by Zoom as “a technical preview, which means we’re proactively soliciting feedback from users for the first 30 days.” In this approach, “the keys for each Zoom meeting are generated by participants’ machines, not by Zoom’s servers. Encrypted data relayed through Zoom’s servers is indecipherable by Zoom, since Zoom’s servers do not have the necessary decryption key.”
That is indeed a good advance for security, but it means several popular Zoom features will be disabled, including join before host, cloud recording, streaming, live transcription, breakout rooms, polling, 1:1 private chat and meeting reactions. Also, for logical encryption-key reasons, the new encryption only works in environments that Zoom can control, which means the Zoom desktop client, mobile app, or Zoom Rooms. (It won’t work if the user enters via direct browser access and certainly not if someone dials into the call.)
Those are non-trivial limitations. Zoom head of security engineering Max Krohn said in an interview that the temporarily lost Zoom features (as opposed to how a Zoom meeting is accessed) will be brought into the new encryption environment one-at-a-time; Zoom is “hoping for weeks for all those features,” Krohn said. (To nitpick, with no number attached to “weeks,” it’s fairly meaningless. That might be 52 weeks.)
From a CIO and CISO perspective, the question of whether to use Zoom’s new encryption is tricky. If none of the temporarily-blocked services is to be used in a meeting, it’s an easy call to upgrade security and try it out. If, however, some of those features are important, it becomes an issue of how sensitive the discussions are and, realistically, how likely is it that a bad guy will try and access the meeting.
“I would use it all of the time unless there were some features I absolutely needed, such as dial-in,” Krohn said. Dial-in is popular for users with low bandwidth, when joining the call from a car, or when a user simply won’t be able to watch the call, such as if they need to take extensive notes.
Enabling the new encryption is fairly straight-forward: “Hosts can enable the setting for E2EE at the account, group, and user-level and can be locked at the account or group level,” the company said. “All participants must have the setting enabled to join an E2EE meeting.” Despite reports that the setting must be enabled before every meeting, Krohn said that isn’t true, but it can be made the default option.
For the next phase of encryption, Zoom plans to offer enhanced identity management and as well as encrypted single sign-on (SSO), but that won’t happen until sometime next year. (Krohn wouldn’t be any more specific.)
From a security perspective, better encryption only helps so much if the system can’t adequately confirm who is on the call. After all, without good authentication, an intruder could simply impersonate an authorized user and all data is then unencrypted for the intruder. Not good.
There are some practical limitations to how far an attacker can go, but much depends on the nature of the meeting. Is it a board of directors call? Won’t someone quickly notice that two “Helens” are on the call and the board only has one? Won’t the voice be recognized as not Helen, as well as the video? The only chance an impersonator would have is to join the call with no video and say nothing and then hope that the real person doesn’t show up and didn’t tell anyone that she wouldn’t show up. That’s fairly unlikely.
But if it’s a much larger number of people, an impersonator has a better chance. Therefore, this level of encryption may be less effective for larger groups, which is true for any discussion of sensitive material. (I once covered a “confidential” AT&T call for, wait for it, all global employees. That was hundreds of thousands of people, at the time. To argue that the discussion had a reasonable expectation of privacy was laughable. In this context, using high-level encryption would have made little sense.)
There is also the issue of an attacker installing Trojan Horse keystroke-capturing malware on a target executive’s machine — most likely via an email phishing attack — so that the machine truly appears to be the executive. Again, good encryption there doesn’t help much.
“There’s not much we can do in a case of a compromised endpoint,” Krohn said.
