GEIS-新闻详情

askST: Are Web conferencing tools, hotel Wi-Fi and landlines protected against eavesdropping?

2024-03-10 00:00:00.0 海峡时报-新加坡原网页

SINGAPORE - A conference call held by senior German military officials was intercepted by Russia and leaked to the public, raising questions about the security of Web conferencing tools, hotel phone lines and public Wi-Fi connections.

Revealing the initial results of an ongoing investigation, German Defence Minister Boris Pistorius said on March 5 that a German military officer participating in the Singapore Airshow in February had used an unsecured line at a Singapore hotel to join the Webex call.

The leaked audio features four high-ranking German air force officers discussing hypothetically how long-range cruise missiles could be used by Kyiv against invading Russian forces.

The Straits Times spoke to cyber-security experts to find out how the leak could have happened and the precautions one must take to secure Web conferencing calls, which experienced a spike in popularity during the Covid-19 pandemic.

Q: Are Web conferencing calls secure?

A: Major Web conferencing platforms like Zoom and Webex offer end-to-end encryption, which means that anyone not authorised to listen in cannot make sense of the audio, visual and text transmission.

Encryption makes it difficult to eavesdrop, said Mr Kevin Reed, chief information security officer at cyber-security firm Acronis.

In Germany’s case, its military did not use an off-the-shelf version of Webex, but a specially certified one installed on servers owned by the military and located in its armed forces’ computing centres in Germany, Mr Pistorius said. This set-up offers the highest level of security.

Get a round-up of the top stories to start your day

Thank you!

By signing up, I accept SPH Media's Terms & Conditions and Privacy Policy as amended from time to time.

Yes, I would also like to receive SPH Media Group's SPH Media Limited, its related corporations and affiliates as well as their agents and authorised service providers.

marketing and promotions.

But these tools allow participants to dial in through regular telephone landlines, which have no encryption and may be tapped, said Mr Vitaly Kamluk, cyber-security firm Kaspersky’s Asia-Pacific director of global research and analysis.

Web conferencing platforms provide this option to participants without Internet access, but it also allows people to eavesdrop.

“When you dial in using a landline, a copy of the decrypted call is created, compromising the security,” said Mr Reed. To better secure such calls, users should disable the landline option, he added.

Some speculated that Germany’s Brigadier-General Frank Grafe, who was here for the Singapore Airshow, had dialled in from a regular telephone line from the hotel.

There was also speculation that Germany’s Webex server had been hacked. But Mr Reed does not think so.

The strategic advantage of keeping this a secret would outweigh the benefits of leaking the contents of the call, he said. “Why would they alert Germany to patch any vulnerabilities? I think it was a random, one-time success.”

Q: How else can Web conferencing calls be compromised?

A: Web conferencing call invites contain a phone number and a call passcode. To enter the call, participants need to key in the call passcode. Sometimes, a personal identification number is also needed.

Technically, anyone who receives the invite can join the call.