Corporate spy risks from free email

Powered by SC Magazine
 

Gmail, Yahoo! Mail and Hotmail "completely vulnerable" by default.

Small business users of Gmail, Yahoo! mail and Hotmail were vulnerable to corporate spies when logged into their accounts on public Wi-Fi networks, a penetration tester has found.

Business users of public Wi-Fi hotspots, such as those at cafes, who sent commercially sensitive information were at risk, said Hacklabs tester Chris Gatford.

Employees of small businesses often used free email services as their main business email accounts.

"By default, users of all three popular webmail services are completely vulnerable once logged in via public Wi-Fi," Gatford said.

Only Gmail had an option to always use HTTPS, a secure way to send information over the web but it had to be manually enabled making it likely most users were not protected.

Gatford demonstrated that the login process (usernames and passwords) was encrypted with secure socket layer (SSL). But once logged in over public Wi-Fi, documents and text in a default Gmail, Yahoo! or Hotmail account were transmitted in a way that someone with wireless sniffing tools such as Wireshark, Hamster or Ferret could easily intercept, he said.

Chris Soghoian, a fellow at Harvard's Berkman Center for Internet and Society said "users of public Wi-Fi should be worried" if they used Wi-Fi to access free webmail services.

Why do cloud webmail services not have SSL by default?

Soghoian said that webmail services had a strong incentive not to force SSL because "using and processing SSL transactions consumes vastly more processing power than regular transactions ... so providing users [full-time SSL] protection costs money".

Spokesmen for Yahoo!, Microsoft and Google told iTnews that their webmail login pages were secured with HTTPS and indicated they were "currently looking into" making it the default setting.

But several expressed concern that blanket implementation would result in a slow or unreliable user experience.

In a shot across the bows of Yahoo! and Microsoft, Google said "no other major webmail provider offers free, always-on HTTPS, and most don't provide any support for HTTPS at all".

Google said it "strives to provide a high level of security to our users" and "enables users to access a number of applications including Gmail, Docs and Calendar via HTTPS".

"Google Apps administrators also have the option to enforce HTTPS across an entire domain," the spokesman said

Google encouraged users to read its help centre and educational blog posts about account security.

Yahoo! said it "takes online security seriously and take steps to safeguard user information".

"[We have] offered SSL and other password encryption methods for many years [and] rolled out SSL as our standard Web login approach across the Yahoo! network to deliver industry-standard encryption [but only for the login process]," a spokesman said.

"We are continuing to explore additional opportunities to embed SSL into the Yahoo! Network ... and recommend users read Safety Tips when Accessing Yahoo! Mail Using Public WiFi Spots."

A Microsoft spokesman said it offered encryption via SSL as an "option at log-in" and that "HTTPS is not necessarily a panacea ... other vectors need equal attention [so] we are investing in comprehensive solutions such as stronger credentials and protection against cookie replay attacks".

Microsoft encouraged Hotmail users to read its tips for protecting your privacy when using public WiFi.

How to secure your webmail

Gmail users should enable the setting to always use HTTPS.

Yahoo! and Hotmail users don't have this choice and should avoid sending any financial, private or commercially sensitive information using these accounts over Wi-Fi.

Gatford said anyone using a free webmail service for business should only ever access it in public over mobile broadband using 3G USB adaptors offered by Optus, Vodafone/Three or Telstra.

He said that information transmitted over these telecommunications networks was much more difficult to intercept and copy.

Update: Google has announced that it is to standardise around HTTPS for its web mail service Gmail.


Corporate spy risks from free email
 
 
 
Top Stories
Content, cost & constant innovation: How Foxtel plans to take on Netflix
Nell Payne inhabits the “brave new world of blue strings and networking”. Just don't ask her to put a TV screen on your microwave.
 
Sending in the drones
Margins are getting tighter in the industrial services industry, so Transfield Services' Stephen Phillips looks offshore - and to the skies - for the solutions he needs to keep pace.
 
Westpac fires starting pistol on core banking upgrade
St George readies itself for move to Celeriti.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Microsoft launches Office for Android preview
May 22, 2015
Microsoft has launched a preview of Office for Android smartphones. Pre-release versions of ...
Microsoft is working on an iOS email chat feature called Flow
May 22, 2015
Microsoft is working on a new chat app, but at the moment we know more about what we DON'T know, ...
Windows 10 free upgrade: Microsoft details who gets what
May 22, 2015
Microsoft was meant to be streamlining its OS with Windows 10, so why is upgrading so confusing? ...
Windows 10 has an edition to suit everyone's needs
May 15, 2015
Microsoft unveils a mind-melting six editions of Windows 10 ahead of its Winter 2015 launch. ...
Firefox 38 FINAL released, debuts new tab-based preferences
May 13, 2015
Mozilla has unveiled the latest version of Firefox 38.0 FINAL for desktop, with Firefox for ...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  43%
 
No
  57%
TOTAL VOTES: 536

Vote