Collaborate with security you can trust

Google Meet is a secure cloud solution that enables you to organize both individual and group video conferences. The platform offers many opportunities for collaboration, such as the well-known Jumpboard. As for the participants, Google Meet allows even unregistered guests to join the conference using the meeting code.

Security

The solution was initially created as a business tool in the Google Workspace suite, but eventually became available for non-commercial use. To protect personal data, the online meeting platform adheres to TLS and SSL standards for encryption at the transit level. Registered Google users also have the option to enable two-factor authentication using FIDO-compatible text messages, authentication apps, or security keys.

Vulnerabilities

Google Meet does not support end-to-end encryption: instead, it uses DTLS-S RTPto protect connections. However, it may be an unpleasant discovery for some that the vendor of the solution stores data on delays and performance. Such “collectible” information includes the data transfer rate, estimated bandwidth, names of conference organizers, IDs of participants, IP addresses, as well as the date and calendar ID of the meeting.

Security researchers recently highlighted a vulnerability in Google Meet’s URL redirection feature, which could lead users to counterfeit domains and make them victims of cybercriminals. Furthermore, if you join a meeting from a smartphone, the audio is transmitted over the telephone network and may not be encrypted.

Slack is a corporate messenger that can support video chats for up to 15 users. As with other vendor services, this solution requires mandatory login to your account and uses a secure system to protect confidential data. This is explained by the fact that Slack supports integration with almost 100 third-party services, such as Dropbox, Google Drive, and even Twitter.

Security

Data transfer between the messenger and the Black service is carried out using reliable encryption protocols and signatures, such as TLS 1.2, AES-256 and SHA2. It is noteworthy that such a protection system only works with the consent of the user, who must approve the processing of his or her personal information. Confidential data at rest in the Slack production network is encrypted in accordance with FIPS 140-2 standards, including relational databases and file storage. At the same time, all encryption keys are stored on a secure server with restricted access.

Vulnerabilities

If you are going to use Slack for business purposes, you need to be aware of the associated risks.

In 2015, Slack was hacked, revealing flaws in the messenger’s security system. The company announced that its system had been hacked, and the attackers had access to the database for four days, jeopardizing the privacy of its users. After the cyberattack, Slack experts also discovered suspicious activity from some accounts that had been clearly compromised by criminals.

In 2019, Tenable specialists also discovered a vulnerability in the Windows version of Slack. The client application provided an opportunity to change the download destination and steal, modify, or add malware to files. The critical vulnerability also allowed for remote code execution (RCE). Hackers could gain full remote control over the Slack desktop application with a successful exploit, thereby gaining access to private channels, conversations, passwords, tokens, and keys.

Skype, created by Microsoft, is a free software for making video calls. The “Meet Now” option allows presenters to invite both registered participants and anyone else in general to a virtual meeting, without needing an account. As for commercial purposes, it is worth noting that Skype for Business will cease to exist on July 31, 2021.

Security

Skype uses AES, also known as Rijndael, which is employed by the US government to safeguard confidential information. At the same time, the encryption itself is 256-bit and has proven to be reliable. The Skype server uses 1536 or 2048-bit RSA certificates to certify users’ public keys.

Vulnerabilities

By default, Skype does not use end-to-end encryption, meaning that Microsoft can view all messages, calls, and files. In addition, the vendor records people’s interactions on their platform, including but not limited to:

• Chat history
• Activity status
• Telephone numbers
• Files sent and received
• Time and duration of calls

Microsoft claims that it also collects user data from third parties, even brokers. Additionally, the corporation utilizes personal information for targeted advertising, personalization, research and development, and to improve its products. Personal data is also shared with Microsoft affiliates, subsidiaries, and suppliers.

The WebEx video conferencing platform has existed since 1995 and is widely used by privacy-conscious companies in the healthcare, information technology, and financial services industries. This is partly because all three sectors had resorted to virtual meetings long before the COVID-19 pandemic, but mostly due to the solution’s reputation for maintaining strong cybersecurity. WebEx’s parent company, Cisco, has long established itself as a reliable and secure vendor for corporate interactions.

Security

By default, WebEx makes user data readable by the server, but it also offers additional end-to-end encryption for up to 200 users, which is more than many of its competitors. Holders of free accounts can contact customer support to further protect themselves. Despite considering the possibility of hosting an on-premises solution, the vendor offers a Cisco Meeting Server for these purposes.

Vulnerabilities

In 2020, Cisco engineers prepared fixes for three vulnerabilities that hackers could exploit during WebEx conferences. IBM discovered security breaches that allowed an attacker to join an online meeting as a ghost user and gain access to personal data. Therefore, a cybercriminal could discover the full names, email, and IP addresses of conference participants.

It is highly likely that you have friends or relatives on WhatsApp, as this messenger already has over two billion users. The solution was created in 2009, but it reached its peak popularity in 2015 and even became the main means of communication in several countries, including Latin America. WhatsApp enables users to organize personal and group chats, make audio and video calls, share files, locations, and even create polls.

Security

To ensure privacy, the solution supports end-to-end encryption, which prevents even company employees from viewing your messages or listening to conversations. WhatsApp also allows users to enable two-step verification to further protect their personal data and send disappearing messages.

Vulnerabilities

In January 2021, Meta announced an update to its privacy policy, stating that WhatsApp would store personal metadata and share it with Facebook and its “family of companies” (e.g., Facebook Messenger, Instagram) starting in February of that year. Previously, users could refuse to transfer information in the settings, but now this feature is not possible. So cyber awareness is something you need to keep in mind at all times using WhatsApp.

In 2022, as a result of the leak, nearly 500 million users’ personal data was released into the network. As it turned out, Meta had been storing users’ confidential information in an almost unencrypted form for many years, resulting in hackers being able to easily bypass the security system and gain access to it. In the following years, residents of 84 countries, including the United States, Italy, and France, suffered from the actions of fraudsters and criminals.

Zoom is a video communication platform that offers a wide range of collaborative tools. The solution gained the most popularity in 2020 during the pandemic, as many companies and organizations started using it for remote work. It is noteworthy that many enterprises continued to use Zoom even after the lockdown was lifted, demonstrating its continued great demand.

Security

When using a Zoom client, video, audio, and screen sharing are protected in transit with AES-256 and a one-time key for that specific session. To further protect your privacy, the solution allows you to enable additional end-to-end encryption.

Vulnerabilities

“Zoombombing” is still a huge stain on the company’s reputation in terms of security. The precedent of intruders appearing in conferences and subsequently demonstrating profanity has become one of the largest hacker attacks in the history of video communication. Attackers could also send, edit, and remove chat messages, as well as remove other participants from online meetings.