Corporate spy risks from free email

Powered by SC Magazine
 

Gmail, Yahoo! Mail and Hotmail "completely vulnerable" by default.

Small business users of Gmail, Yahoo! mail and Hotmail were vulnerable to corporate spies when logged into their accounts on public Wi-Fi networks, a penetration tester has found.

Business users of public Wi-Fi hotspots, such as those at cafes, who sent commercially sensitive information were at risk, said Hacklabs tester Chris Gatford.

Employees of small businesses often used free email services as their main business email accounts.

"By default, users of all three popular webmail services are completely vulnerable once logged in via public Wi-Fi," Gatford said.

Only Gmail had an option to always use HTTPS, a secure way to send information over the web but it had to be manually enabled making it likely most users were not protected.

Gatford demonstrated that the login process (usernames and passwords) was encrypted with secure socket layer (SSL). But once logged in over public Wi-Fi, documents and text in a default Gmail, Yahoo! or Hotmail account were transmitted in a way that someone with wireless sniffing tools such as Wireshark, Hamster or Ferret could easily intercept, he said.

Chris Soghoian, a fellow at Harvard's Berkman Center for Internet and Society said "users of public Wi-Fi should be worried" if they used Wi-Fi to access free webmail services.

Why do cloud webmail services not have SSL by default?

Soghoian said that webmail services had a strong incentive not to force SSL because "using and processing SSL transactions consumes vastly more processing power than regular transactions ... so providing users [full-time SSL] protection costs money".

Spokesmen for Yahoo!, Microsoft and Google told iTnews that their webmail login pages were secured with HTTPS and indicated they were "currently looking into" making it the default setting.

But several expressed concern that blanket implementation would result in a slow or unreliable user experience.

In a shot across the bows of Yahoo! and Microsoft, Google said "no other major webmail provider offers free, always-on HTTPS, and most don't provide any support for HTTPS at all".

Google said it "strives to provide a high level of security to our users" and "enables users to access a number of applications including Gmail, Docs and Calendar via HTTPS".

"Google Apps administrators also have the option to enforce HTTPS across an entire domain," the spokesman said

Google encouraged users to read its help centre and educational blog posts about account security.

Yahoo! said it "takes online security seriously and take steps to safeguard user information".

"[We have] offered SSL and other password encryption methods for many years [and] rolled out SSL as our standard Web login approach across the Yahoo! network to deliver industry-standard encryption [but only for the login process]," a spokesman said.

"We are continuing to explore additional opportunities to embed SSL into the Yahoo! Network ... and recommend users read Safety Tips when Accessing Yahoo! Mail Using Public WiFi Spots."

A Microsoft spokesman said it offered encryption via SSL as an "option at log-in" and that "HTTPS is not necessarily a panacea ... other vectors need equal attention [so] we are investing in comprehensive solutions such as stronger credentials and protection against cookie replay attacks".

Microsoft encouraged Hotmail users to read its tips for protecting your privacy when using public WiFi.

How to secure your webmail

Gmail users should enable the setting to always use HTTPS.

Yahoo! and Hotmail users don't have this choice and should avoid sending any financial, private or commercially sensitive information using these accounts over Wi-Fi.

Gatford said anyone using a free webmail service for business should only ever access it in public over mobile broadband using 3G USB adaptors offered by Optus, Vodafone/Three or Telstra.

He said that information transmitted over these telecommunications networks was much more difficult to intercept and copy.

Update: Google has announced that it is to standardise around HTTPS for its web mail service Gmail.


Corporate spy risks from free email
 
 
 
Top Stories
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
How technology will unify Toll
The systems headache formed through 15 years of acquisitions.
 
Immigration breached Privacy Act with data leak
Pilgrim slams "copy and paste" of asylum seeker data.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Optus steps up regional 4G coverage
Nov 20, 2014
Once 700Mhz services are working, Optus claims regional users will have a "faster and more ...
This Huawei 4G phone costs $99
Nov 12, 2014
The $99 Huawei Ascend Y550, available through Vodafone, enters the budget market as one of the ...
4G smartphones: Microsoft's Lumia 830
Nov 7, 2014
Microsoft has announced its flagship Windows Phone, the Nokia Lumia 830 4G, will be available in ...
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Optus expands 4G coverage
Oct 10, 2014
If you rely on an Optus phone for work you might be interested to know that there are now 200 ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 811

Vote