Zoom has been getting a lot of attention from the media and the criminal elements of the Internet due to its sudden, massive surge in popularity–10 million users to 200+ million users. There is not a popular application or operating system out there that has not had its share of major incidents. For example, Microsoft releases security patches at least once every month. Most of the time Microsoft is fixing vulnerabilities that can be used to hijack a computer system. Google regularly issues patches for Google Chrome that fix vulnerabilities that could allow a malicious website to execute code on the computer. Sometimes we get multiple patches a week from Google. Likewise, the same happens to Mozilla Firefox.
Hopefully I am not scaring you away from your computer, but I want to make sure our look at Zoom is taken in context. Where were the news articles about Windows, Chrome, and Firefox? They have a much larger user base than Zoom. Yet these security issues have become so routine, they often only get noticed by IT people like myself that are actively watching for security alerts.
Further, many of the articles we are seeing are from Zoom users doing unwise things that are completely out of the control of Zoom. A recent article I saw was about Zoom users uploading recordings of their Zoom meeting online for everyone on the Internet to see. There is nothing Zoom can do to stop people from uploading files to the Internet so that anyone can see them–these same people probably upload all sorts of files with improper permissions. Another article covered a user that disabled passwords on their Zoom meetings to make it easier for their participants to join–it also makes it easy for the bad guys to join. Most of the Zoombombing incidents have been caused by the host or participants accidentally (or in some cases intentionally) sharing the meeting ID and password publicly for anyone to find. Sometimes this happens because they have set their calendars to be publicly accessible. A lot of this reporting is sensationalism just to get clicks and advertising revenue in a time when web news sites are actually under enormous financial pressure. Most advertisers have been cutting back altogether or rejecting advertising on articles that mention keywords related to the pandemic. This has driven the pay per click/view in advertising way, way down.
However, there is also legitimate criticism of Zoom that has been reported.
- Zoom claimed they used AES 256 encryption but in some instances AES 128 would be used. AES 256 is used for Top Secret communications by the government, UNI and most of the Internet actually uses AES 128 for most encryption needs. If Zoom had said they used AES 128 or just simply said AES, it would have been fine. Shortly after discovery, Zoom migrated fully to AES 256.
- Zoom claimed to use end-to-end encryption. The traditional tech meaning of end-to-end has been that communications are encrypted by one user and are not decrypted until they get to the other user, so no points in the middle could see unencrypted data. That technique actually does not work well in a large video meeting where the same information needs to be broadcast to multiple users. So they actually encrypt from the client to the server, decrypt there, then encrypt again when the data is sent back to the other clients in the meeting. The actual video and audio data is encrypted with a shared encryption key used by all users on the same call. This admittedly is a poor implementation of encryption, but it is an efficient way to communicate while still enabling some privacy. WebEx, a competitor to Zoom, does have true end-to-end encryption as an option, but when it is used many features of the software get disabled–so most meetings in WebEx are not end-to-end encrypted either. When pointed out to Zoom, they admitted they were not using the same definition for end-to-end encryption as most tech companies now use. Zoom has announced plans to improve the quality of encryption used in Zoom.
- Zoom used an off-the-shelf software development kit (SDK) for mobile apps designed by Facebook to allow Zoom users to use Facebook as their authentication credentials. When the SDK was used, it also sent limited analytics data about the mobile device back to Facebook. Such analytics sharing is very, very common in mobile apps and all over the Internet, but it must be disclosed if you dig into the privacy policies and documentation. When discovered, Zoom removed the SDK and integrated Facebook authentication in a different manner.
- Zoom used a workaround on the Mac versions to allow the software to install and run without requiring the user to approve access to the webcam and microphone as Mac OS normally requires now. This was done to make the software easier to use, but legitimate software using such a technique is a major faux pas and opened up the system to other apps being able to gain the same access. This "feature" was removed back in July of 2019.
- Zoom had an issue where malicious links sent via chat could cause a user’s computer username and password to be sent to a remote server if the link was clicked. This is as much a flaw in Windows as it is in Zoom. All Zoom did in that instance was pass a server link sent via its chat feature to Windows for processing and Windows decided in its wisdom to send the username and password for the computer to the remote server listed in the link–but this would only happen if the user clicked the link. This issue has since been patched by Zoom.
Now, all of the above criticisms of Zoom are valid. However, I have seen plenty of other software programs and websites make the exact same or similar mistakes. Here are a couple examples, but this list could be endless.
- Microsoft added intensive analytics and data gathering to Windows 10 and then back-ported the analytics to their older versions of Windows in an automatic update without adequate disclosure to the users.
Again, I am not saying that Zoom did no wrong, just that it is entirely typical in how the modern tech community regularly sidelines the privacy and security of users in the name of innovation. We are aware of what Zoom really is doing and view it as no more risky than any other communications and educational platform we regularly use.
As for what you should do to protect yourself when using Zoom, the same advice for Zoom also applies to email, web links, etc. Do not click on links unless you absolutely trust the person that sent it. Likewise, only accept file transfers within Zoom from users you absolutely trust. Whenever possible, do not disable the security features UNI has set as defaults for Zoom. If problems with participants are anticipated, contact the IT Service Desk for advice on configuring Zoom to minimize possible disruptions. Like any other application, Zoom should be updated when security updates come out. Zoom has been quick to patch as issues have been identified.
Likewise, you should keep your operating system, browsers, and other software up-to-date. Many attacks actually use multiple vulnerabilities strung together. Further, you should be vigilant when using the computer. Watch out for things that just do not make sense. Many attacks still require user participation in some fashion–approving an application to run, manually starting an application that was downloaded, allowing a program administrative rights, downloading a suspicious attachment, etc. Be skeptical of anything that seems out of the ordinary. Certainly never trust pop-ups and websites that claim your computer is "infected" or that direct you to call a number to have your computer fixed. Please watch out for phishing attacks, see our website at https://it.uni.edu/phishing for more details about them.
The last thing I will point out is to keep a perspective on other technologies we use all the time and compare their security to that of Zoom. For example, most people do not hesitate to use email, but depending on who you send your email to or how it is routed over the Internet, it is completely possible for it to travel entirely unencrypted over the public Internet. Even if it is encrypted, each mail server along the path will have access to the decrypted contents. Yet we use email all the time for private conversations, online password resets, etc. Social network sites are gathering all types of data from all over the Internet. Google is gathering data from most websites, from its search, from email, and even partnering with credit card companies to link purchases to people to deliver targeted advertising. Many phone conversations, but not all, are routed over the public Internet with minimal security. Yet most of us use these technologies all the time. As such, we should all be more aware of the risks our data and information are subject to all the time, and be vigilant about protecting information we would prefer to be kept private.
I do not have any concerns using Zoom and see it as a perfectly acceptable technology to use in higher education, but I am aware of its limitations. There is always a trade-off between usability and security that must be balanced. In fact, for home users Zoom recently changed that balance towards more secure defaults to protect their novice users. Like any technology, some responsibility lies on the users to properly use the software. That said, I certainly would never use Zoom as the British government did for a cabinet meeting–there the security implications are significant enough to warrant end-to-end encryption with unique login credentials for each user. But admittedly, that would have been much more difficult to set up on short notice.
Let IT-Information Security know if you have any further questions or concerns. We will be happy to address them. We can be reached at firstname.lastname@example.org. Also, I will fully admit there is room for debate about when a tech company actually "crosses-the-line." Many of us would draw the line in different spots, so there is room for healthy debate in my assessment.
Eric Lukens, IT-Information Security
Information Technology deployed a print release station to the University Book Store (UBS) on March 25th, 2020. This print release station is available for students, faculty, and staff to release their mobile print jobs from. To get started with mobile print, please visit the Mobile Print Getting Started article on the IT website.
If you have questions or run into problems, please open a ticket using Service Hub.
Information Technology (IT) has expanded outdoor WiFi service to include the Noehren Hall Parking lot. This work was in an effort to offer drive up WiFi service for those that would prefer to stay in their vehicle because of social distancing. The outdoor WiFi service map as been updated to include this new location.
Information Technology (IT) has been working directly with Adobe to acquire additional licensing for students at the University. On March 19th, 2020, that licensing was obtained and deployed. This licensing is temporary, but allows students to install these important programs on their personal computers. This temporary license will expire on May 31st, 2020.
Please visit our support article for instructions on how you can access and download these applications to your personally-owned device.
In light of the recent recommendation for all UNI employees to work remotely when possible, Information Technology (IT) has modified its laptop checkout process. The following process is now in place as of Wednesday, March 18th, 2020, at 1:00PM.
Faculty and staff who need to request a laptop should use this form to request one.
Keep in mind when requesting a laptop that all units available are standard Dell models with basic applications installed. If you have questions about working remotely, please visit IT's Remote Services and Support website for information on Remote Desktop, using the VPN, and many other tools.
It is important to fill out the form above prior to taking any other action. Without filling out the form, you will not be granted electronic access to the room where the laptops are stored. The following steps are the process once you've filled out the Service Hub request form:
- Once you have filled out the request form, IT will work with Facilities Management staff to get your ID card added for electronic access to Sabin Hall room 103.
- When the access has been granted, your Service Hub ticket will be updated to to let you know you are all set.
- Come to campus between the hours of 8:00AM and 4:30PM Monday-Friday. Head to Sabin Hall room 103. Swipe your UNI ID card at the electronic access terminal and when it goes green, open the door. In front of you and to the right, you can select a laptop off of the table and a power cord from the box directly underneath.
- Power on the laptop and login to Windows with the user name and password provided on the signage. If you are unable to sign in, please shut the laptop down and place it gently in the box near the door. Select a different laptop from the pile.
- After you are signed in, please navigate to the OBO off-campus use of UNI property form and fill it out, making sure to put the computer name (from the white label) in the "Description" box.
- Once you have submitted the form, you are free to head out with your laptop and power cord. Once you are home or at your remote work location, please take a minute to update your Service Hub ticket with the laptop's name and Service Tag (found on the bottom of the laptop or on some of the white labels).
Cedar Falls Utilities will perform maintenance on UNI's secondary Internet connection to increase performance and reliability if our secondary connection is needed. No outage to our primary Internet connection is expected.
Maintenance will take place on Wednesday, March 18th from 8:00am - 9:00am.
There are many fake sites and apps out there trying to take advantage of everyone's concern about the covid-19 threat. It's impossible to list all of them, but these are a couple examples. In general, seek news and information from known safe sources of information.
- A malicious website pretending to host a map of Coronavirus cases around the world (corona-virus-map [dot] com) actually contains the AZORult Trojan that will steal information, including sensitive data.
- A malicious android app that pretends to be a “Coronavirus Tracking App” which is ransomware that will infect the phone and lock it until payment is received. The malicious app is downloaded at (coronavirusapp [dot] site).
This procedure is now out of date, please visit this page for the most recent laptop checkout procedures.
Information Technology (IT), working closely with Academic Leadership, has identified a number of laptops across campus that are being made available to check out on a temporary basis by UNI students and faculty who have a critical need or otherwise do not have access to a device to use to complete their online coursework or instruction. These laptops are available for check out at the IT Service Desk in the Innovative Teaching and Technology Center, room 36. They are available while supplies last on a first come first serve basis. To obtain one, follow the steps below.
- If you are a student, fill out the form located here. If you are a faculty member, fill out the form located here.
- Visit the IT Service Desk in ITTC 36.
- Sign the necessary paperwork.
- The Service Desk staff will review the laptop's functionality with you to ensure it works and you can sign into the computer.
That's all there is to it! If you have any questions or concerns, please don't hesitate to reach out to the IT Service Desk by calling them at 319-273-5555 or by filling out a Service Hub request form by visiting servicehub.uni.edu.
As fears and anxiety continue to rise over the spread of the corona virus across the world, so do email phishing attempts. Those with malicious intent are known to capitalize on periods of rising fear by conducting phishing campaigns that utilize techniques taking advantage of that very fear.
Information Technology urges the campus community to continue its vigilance when deciding whether to trust an email communication and click on any links held within. The IT Phishing Education website highlights several examples sent out to the university community over the past year and explains in each case why the message was a fake, and potentially, a phishing attempt.
As always, if you have concerns about a certain email message that you've received, you can forward it to email@example.com to receive help and guidance on whether or not the message is real.
Information Technology (IT) is constantly working to improve and secure the systems and services it runs. These changes take many shapes, including security updates, upgrades to functionality, and other modifications. These changes are worked on in testing systems and then deployed into production on a regular schedule. Under the circumstances of a campus closure event, IT will change its strategy to allow work to continue and progress to be made, without any changes actually being pushed into production. This may allow progress on system development to continue without introducing unnecessary risk (e.g. system outages, downtime, etc) into an already tense environment where a large number of employees are working from home.
IT continually works with campus leadership to identify those systems and services most crucial to maintaining the University's academic mission and during a campus closure event, our resources will be spent "keeping the lights on" for those systems.
If you have any questions, comments, or concerns, please don't hesitate to open an IT request by visiting Service Hub at servicehub.uni.edu and using the Get IT Help request form.