How to Stop Hackers from Eavesdropping on Your Company Secrets?
Table of Contents
When communicating with colleagues, associates, and customers, you usually expect privacy. After all, discussions could contain company secrets and sensitive information. Unfortunately, both are extremely attractive to cybercriminals. There are many ways that attackers can access sensitive and proprietary information, and eavesdropping on communications is one method used to steal your data. As companies increasingly use video conferencing and smartphones for meetings, preventing eavesdropping should be part of your security strategy.
What is an Eavesdropping Attack?
Eavesdropping is listening in on conversations or other forms of communication without the victim's knowledge or consent. In the context of cybercrime, eavesdropping can be as damaging as any other cyberattack.
Examples of eavesdropping cover many types of nefarious outcomes. One man was accused of insider trading after listening to his wife's phone calls as she worked from home. The US Securities and Exchange Commission accused the husband of making $1.76m in illegal profits. Another instance of eavesdropping is the case of Airbus, which filed a complaint against the NSA, accusing the organization of spying on the company.
Other outcomes of eavesdropping include industrial espionage or theft of sensitive or customer data. In the case of data theft, the stolen information can be used as part of follow-on attacks like malware infection or Business Email Compromise (BEC).
Ways that Cybercriminals Eavesdrop on You and Your Business
Wireless Network Eavesdropping
WiFi vulnerabilities are a common way that cybercriminals can circumvent security by eavesdropping. Cybercriminals use tools for "network sniffing" to intercept data transmitted across unsecured wireless networks.
Packet Sniffing Tools
The packet sniffing tools mentioned above are readily available as system administrators and security professionals use them to locate data packets legitimately. However, the same technology allows cybercriminals to sniff packets on insecure wireless networks.
WiFi Vulnerabilities
WiFi standards may have vulnerabilities that allow attackers to eavesdrop on network traffic and connect victims to untrusted networks. A recent example was the discovery of a vulnerability in the IEEE 802.11 WiFi standard that facilitated eavesdropping by tricking systems into connecting to networks with lower security.
Acoustic Eavesdropping
Acoustic eavesdropping is a prime example of the ingenuity of cybercriminals. An academic paper explains how hackers can use gyroscopes and accelerometers in smartphones to detect sound vibrations in the air and listen in on conversations. "Hackers can turn your smartphone into an eavesdropping device.
Virtual Meeting Eavesdropping
Research from Check Point has found ways that virtual meeting eavesdropping compromises Zoom by exploiting vulnerabilities, allowing attackers to eavesdrop on company meetings. Fortunately, this vulnerability has been fixed. However, vulnerabilities, including zero-day vulnerabilities (those not yet patched), are still being found in virtual meeting platforms. A recent example is an exploit using Zoom's Zero Touch Provisioning (ZTP) flaw.
Virtual Assistant Spies
Virtual assistants are not immune to becoming a conduit for malicious eavesdroppers. Targets can be tricked into running a malicious skill in a hack known as "voice squatting" and "voice masquerading" attacks. Once initiated, the skill runs and is used to steal sensitive user information and eavesdrop on conversations.
A recent Apple and Siri court case resulted in Apple agreeing to pay $95 million in a preliminary settlement; the iPhone voice assistant Siri was alleged to have been eavesdropping on conversations.
VR Headset Eavesdropping
Even HR headsets can offer a way for cybercriminals intent on stealing data. A feature called Face-mic can be used to interpret speech-associated facial dynamics to steal sensitive information. This data can include credit card data and passwords.
What are the Outcomes of an Eavesdropping Attack?
Eavesdropping attacks are all about obtaining data. This data is either used directly or for follow-on attacks:
Stolen Sensitive Data
Cybercriminals can obtain a variety of data by using eavesdropping techniques. For example, by listening in or intercepting company communications and conversations, an attacker can obtain company secrets, including Intellectual Property (IP). This information can then be used to extort money from a company by threatening to release the information or by selling it to competitors or the media. IP loss has been shown to cost a company 50% of its market share.
Financial Theft and Fraud
Most cybercrimes are financially motivated. Cybercriminals may use eavesdropping to obtain banking data or other financial intelligence in an effort to commit fraud. For example, hackers can intercept a financial transaction using a sophisticated skimming tool installed on ATMs, point-of-sale terminals, etc. Bluetooth technology within the skimmer allows cybercriminals to steal data wirelessly. The FBI estimates the costs of skimming are over $1 billion annually.
Privacy Exposure and Violations
Privacy exposure is a high-risk outcome of eavesdropping. The loss of employee or customer data because of a cyberattack, including eavesdropping, is a potential violation of data protection regulations. Data exposure can result in non-compliance fines, including GDPR, HIPAA, and CCPA. In the case of GDPR, fines are in the region of €20 million or 4% of annual revenue, whichever is greater.
Increased Identity Theft Risk
Data exposed through eavesdropping can include personal data. This data can be used to compromise existing identity accounts or create new accounts using the victim's details. Either way, the individual is at high risk of identity theft and fraud, including illegitimate financial transactions.
Company Reputation Damage
Companies that compromise customer data because of lax security protection, which leads to eavesdropping, are at risk of reputation damage. Once a company loses its positive brand status, it can be hard to build up trust with a customer base.
How to Protect Your Company From Eavesdropping
Data Encryption
Insecure networks and data make eavesdropping easier. Use standard encryption protocols like Transport Layer Security (TLS) to encrypt data and communications when transmitted and during highly sensitive conversations. Email encryption solutions can also help mitigate eavesdropping via email.
Network Monitoring
Monitor the network to identify potential intrusions. Intrusion detection and prevention (IDP) solutions help identify eavesdropping attempts and can help prevent attacks.
Virtual Private Network (VPN)
A VPN will ensure that any network traffic, like communications, is encrypted. A VPN also enhances the privacy of communications.
Security Awareness
Train employees about the potential for eavesdropping and why it can occur. Employee education must include safe internet use and how to avoid insecure public WiFi.
Software Patches
Keep software up-to-date to avoid security flaws from being exploited as part of an eavesdropping attack.
Network Segmentation
By implementing network segmentation, an organization effectively limits access to IT resources, only allowing access on a need-to-know basis. By dividing the network into segments, a company makes any attempts at unauthorized access harder by isolating sensitive parts of the network.
FAQs
What's the Difference Between Eavesdropping and Man-in-the-Middle (MitM) Attacks?
Eavesdropping attacks are passive. The attacker does not change the conversation or other communication but instead steals or exposes the information in the exchange. In contrast, MitM attacks are active attacks that intercept and often modify the intercepted communication. However, sometimes eavesdropping may be viewed as a passive form of a MitM attack.
Can Encryption Stop Eavesdropping?
Encryption can mitigate eavesdropping, but it should be used along with other measures to help reduce the risk further. These measures include regularly updating software to ensure attackers cannot exploit software vulnerabilities. Other measures must prevent unauthorized access, like network segmentation, which could be used to circumvent encryption.
Can Companies Use Eavesdropping Legitimately?
Companies can legally use various forms of eavesdropping. For example, AI-enabled "bossware" is an employee monitoring app that typically falls under the umbrella term eavesdropping.