Mass move to work from home creates opening for hackers

WASHINGTON: As people disperse to their homes to work and study because of the coronavirus pandemic, taking their laptops and company data with them, cybersecurity experts say hackers will follow, seeking to take advantage and infiltrate corporations.

Government officials in the US, Britain and elsewhere have issued warnings about the dangers of a newly remote workforce, while tech companies are seeing surges in requests to help secure out-of-office employees. At Cisco Systems, for example, the number of requests for security support to support remote workforces have jumped 10-fold in the last few weeks.

“People who have never worked from home before are trying to do it and they are trying to do it at scale,” said Wendy Nather, a senior adviser with Cisco’s Duo Security who has spent the past decade working from home for various jobs.

She said the sudden transition would mean more scope for mistakes, more strain on information technology staff, and more opportunity for cybercriminals hoping to trick employees into forking over their passwords.

Criminals are dressing up password-stealing messages and malicious software as coronavirus-themed alerts, warnings, or apps. Some researchers have found hackers masquerading as the US Centers for Disease Control and Prevention in a bid to break into emails or swindle users out of bitcoin, while others have spotted hackers using a malicious virus-themed app to hijack Android phones.

Advanced cyber spies also appear to be exploiting the coronavirus outbreak.

Last week researchers at Israeli company Check Point discovered suspected state-backed hackers using a booby-trapped coronavirus update to try to break into an unidentified Mongolian government network.

On Friday US cybersecurity officials released an advisory warning companies to update their Virtual Private Networks (VPNs) and be on guard against a surge of malicious emails aimed at an already disoriented workforce. On Tuesday, Britain’s National Cyber Security Center issued a six-page leaflet for businesses managing remote employees.

Cybercriminals are alert to the work from home trend “and they are doing what they can to use it to infiltrate into organizations,” said Esti Peshin, head of the cyber division at state-owned Israel Aerospace Industries, Israel’s largest defense contractor.

The opportunities for hackers are manifold.

Many workers are moving their employers’ data from professionally managed corporate networks to home Wi-Fi setups protected with basic passwords. Some organizations are loosening restrictions to allow employers to access work-critical information from their bedrooms or home offices.

Working from home might expose employees to lower-tech threats too, including theft or loss of electronic equipment or plain human error by employees adjusting to a new environment.

Cisco’s Nather said the new population of work-from-home employees might also be a boon for tech support scammers, impersonators who pretend to be trying to fix an IT problem in an effort to gain control of a target’s computer.