Corporate spy risks from free email

Powered by SC Magazine
 

Gmail, Yahoo! Mail and Hotmail "completely vulnerable" by default.

Small business users of Gmail, Yahoo! mail and Hotmail were vulnerable to corporate spies when logged into their accounts on public Wi-Fi networks, a penetration tester has found.

Business users of public Wi-Fi hotspots, such as those at cafes, who sent commercially sensitive information were at risk, said Hacklabs tester Chris Gatford.

Employees of small businesses often used free email services as their main business email accounts.

"By default, users of all three popular webmail services are completely vulnerable once logged in via public Wi-Fi," Gatford said.

Only Gmail had an option to always use HTTPS, a secure way to send information over the web but it had to be manually enabled making it likely most users were not protected.

Gatford demonstrated that the login process (usernames and passwords) was encrypted with secure socket layer (SSL). But once logged in over public Wi-Fi, documents and text in a default Gmail, Yahoo! or Hotmail account were transmitted in a way that someone with wireless sniffing tools such as Wireshark, Hamster or Ferret could easily intercept, he said.

Chris Soghoian, a fellow at Harvard's Berkman Center for Internet and Society said "users of public Wi-Fi should be worried" if they used Wi-Fi to access free webmail services.

Why do cloud webmail services not have SSL by default?

Soghoian said that webmail services had a strong incentive not to force SSL because "using and processing SSL transactions consumes vastly more processing power than regular transactions ... so providing users [full-time SSL] protection costs money".

Spokesmen for Yahoo!, Microsoft and Google told iTnews that their webmail login pages were secured with HTTPS and indicated they were "currently looking into" making it the default setting.

But several expressed concern that blanket implementation would result in a slow or unreliable user experience.

In a shot across the bows of Yahoo! and Microsoft, Google said "no other major webmail provider offers free, always-on HTTPS, and most don't provide any support for HTTPS at all".

Google said it "strives to provide a high level of security to our users" and "enables users to access a number of applications including Gmail, Docs and Calendar via HTTPS".

"Google Apps administrators also have the option to enforce HTTPS across an entire domain," the spokesman said

Google encouraged users to read its help centre and educational blog posts about account security.

Yahoo! said it "takes online security seriously and take steps to safeguard user information".

"[We have] offered SSL and other password encryption methods for many years [and] rolled out SSL as our standard Web login approach across the Yahoo! network to deliver industry-standard encryption [but only for the login process]," a spokesman said.

"We are continuing to explore additional opportunities to embed SSL into the Yahoo! Network ... and recommend users read Safety Tips when Accessing Yahoo! Mail Using Public WiFi Spots."

A Microsoft spokesman said it offered encryption via SSL as an "option at log-in" and that "HTTPS is not necessarily a panacea ... other vectors need equal attention [so] we are investing in comprehensive solutions such as stronger credentials and protection against cookie replay attacks".

Microsoft encouraged Hotmail users to read its tips for protecting your privacy when using public WiFi.

How to secure your webmail

Gmail users should enable the setting to always use HTTPS.

Yahoo! and Hotmail users don't have this choice and should avoid sending any financial, private or commercially sensitive information using these accounts over Wi-Fi.

Gatford said anyone using a free webmail service for business should only ever access it in public over mobile broadband using 3G USB adaptors offered by Optus, Vodafone/Three or Telstra.

He said that information transmitted over these telecommunications networks was much more difficult to intercept and copy.

Update: Google has announced that it is to standardise around HTTPS for its web mail service Gmail.


Corporate spy risks from free email
 
 
 
Top Stories
Australia passes data retention into law
Mammoth last-ditch effort by Greens, indies knocked back.
 
ATO to kill off e-Tax
Veteran software to be replaced by more modern myTax.
 
CSC embroiled in CBA IT bribery scandal
ServiceMesh named in alleged dodgy dealing.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Xero now includes an inventory function built-in
Mar 26, 2015
Xero has added inventory and other major new features to the latest release of its cloud ...
Apple reveals its new MacBook
Mar 13, 2015
Replacing the MacBook Air as Apple's thinnest laptop, the new MacBook comes packed with features.
Xero has released a new version of its app for the iPad
Mar 6, 2015
iPad-wielding Xero users can now take advantage of a new version of the iOS app for the cloud ...
Microsoft is offering Azure for Disaster Recovery to Australian SMBs
Feb 10, 2015
If you haven't talked to your IT provider about disaster recovery, it might be worth discussing ...
The 2015 Xero Roadshow is on: here are the locations and dates
Feb 6, 2015
The 2015 Xero Roadshow kicked off this week - see where you can attend at locations around ...
Latest Comments
Polls
Do you support the Government's data retention scheme?

   |   View results
Yes
  8%
 
No
  92%
TOTAL VOTES: 1134

Vote