(Reuters) — As people disperse to their homes to work and study because of the COVID-19 pandemic, taking their laptops and company data with them, cybersecurity experts say hackers will follow, seeking to take advantage and infiltrate corporations.
Government officials in the United States, Britain, and elsewhere have issued warnings about the dangers of a newly remote workforce, while tech companies are seeing surges in requests to help secure out-of-office employees. At Cisco Systems, for example, the number of requests for security support to assist remote workforces has jumped tenfold in the last few weeks.
“People who have never worked from home before are trying to do it, and they are trying to do it at scale,” said Wendy Nather, a senior advisor with Cisco’s Duo Security who has spent the past decade working from home for various jobs.
She said the sudden transition would mean more scope for mistakes, more strain on information technology staff, and more opportunity for cybercriminals hoping to trick employees into forking over their passwords.
June 5th: The AI Audit in NYC
Join us next week in NYC to engage with top executive leaders, delving into strategies for auditing AI models to ensure fairness, optimal performance, and ethical compliance across diverse organizations. Secure your attendance for this exclusive invite-only event.
Criminals are dressing up password-stealing messages and malicious software as COVID-19-themed alerts, warnings, or apps. Some researchers have found hackers masquerading as the U.S. Centers for Disease Control and Prevention in a bid to break into emails or swindle users out of Bitcoin, while others have spotted hackers using a malicious virus-themed app to hijack Android phones.
Advanced cyberspies also appear to be exploiting the COVID-19 outbreak that has infected more than 210,000 people and killed 8,700 worldwide.
Last week, researchers at Israeli company Check Point discovered suspected state-backed hackers using a booby-trapped COVID-19 update to try to break into an unidentified Mongolian government network.
On Friday, U.S. cybersecurity officials released an advisory warning companies to update their Virtual Private Networks (VPNs) and be on guard against a surge of malicious emails aimed at an already disoriented workforce. On Tuesday, Britain’s National Cyber Security Centre issued a six-page leaflet for businesses managing remote employees.
Cybercriminals are alert to the work from home trend “and they are doing what they can to use it to infiltrate into organizations,” said Esti Peshin, head of the cyber division at state-owned Israel Aerospace Industries, Israel’s largest defense contractor.
The opportunities for hackers are manifold.
Many workers are moving their employers’ data from professionally managed corporate networks to home Wi-Fi setups protected with basic passwords. Some organizations are loosening restrictions to allow employers to access work-critical information from their bedrooms or home offices.
Working from home might expose employees to lower-tech threats too, including theft or loss of electronic equipment or plain human error on the part of employees adjusting to a new environment.
Cisco’s Nather said the new population of work from home employees might also be a boon for tech support scammers, impersonators who pretend to be trying to fix an IT problem in an effort to gain control of a target’s computer.
Israel’s Peshin said that networks used by school children and college students were also at risk, as students are forced to take classes online from home because their institutions have been shuttered in the crisis.
“Remote learning sites tend to be not encrypted and insecure,” Peshin said, calling them “very ripe grounds for cyberattacks against children.”
(Reporting by Steven Scheer in Tel Aviv and Raphael Satter in Washington, additional reporting by Jack Stubbs in London, editing by Chris Sanders and Grant McCool.)
