Corporate spy risks from free email

Powered by SC Magazine
 

Gmail, Yahoo! Mail and Hotmail "completely vulnerable" by default.

Small business users of Gmail, Yahoo! mail and Hotmail were vulnerable to corporate spies when logged into their accounts on public Wi-Fi networks, a penetration tester has found.

Business users of public Wi-Fi hotspots, such as those at cafes, who sent commercially sensitive information were at risk, said Hacklabs tester Chris Gatford.

Employees of small businesses often used free email services as their main business email accounts.

"By default, users of all three popular webmail services are completely vulnerable once logged in via public Wi-Fi," Gatford said.

Only Gmail had an option to always use HTTPS, a secure way to send information over the web but it had to be manually enabled making it likely most users were not protected.

Gatford demonstrated that the login process (usernames and passwords) was encrypted with secure socket layer (SSL). But once logged in over public Wi-Fi, documents and text in a default Gmail, Yahoo! or Hotmail account were transmitted in a way that someone with wireless sniffing tools such as Wireshark, Hamster or Ferret could easily intercept, he said.

Chris Soghoian, a fellow at Harvard's Berkman Center for Internet and Society said "users of public Wi-Fi should be worried" if they used Wi-Fi to access free webmail services.

Why do cloud webmail services not have SSL by default?

Soghoian said that webmail services had a strong incentive not to force SSL because "using and processing SSL transactions consumes vastly more processing power than regular transactions ... so providing users [full-time SSL] protection costs money".

Spokesmen for Yahoo!, Microsoft and Google told iTnews that their webmail login pages were secured with HTTPS and indicated they were "currently looking into" making it the default setting.

But several expressed concern that blanket implementation would result in a slow or unreliable user experience.

In a shot across the bows of Yahoo! and Microsoft, Google said "no other major webmail provider offers free, always-on HTTPS, and most don't provide any support for HTTPS at all".

Google said it "strives to provide a high level of security to our users" and "enables users to access a number of applications including Gmail, Docs and Calendar via HTTPS".

"Google Apps administrators also have the option to enforce HTTPS across an entire domain," the spokesman said

Google encouraged users to read its help centre and educational blog posts about account security.

Yahoo! said it "takes online security seriously and take steps to safeguard user information".

"[We have] offered SSL and other password encryption methods for many years [and] rolled out SSL as our standard Web login approach across the Yahoo! network to deliver industry-standard encryption [but only for the login process]," a spokesman said.

"We are continuing to explore additional opportunities to embed SSL into the Yahoo! Network ... and recommend users read Safety Tips when Accessing Yahoo! Mail Using Public WiFi Spots."

A Microsoft spokesman said it offered encryption via SSL as an "option at log-in" and that "HTTPS is not necessarily a panacea ... other vectors need equal attention [so] we are investing in comprehensive solutions such as stronger credentials and protection against cookie replay attacks".

Microsoft encouraged Hotmail users to read its tips for protecting your privacy when using public WiFi.

How to secure your webmail

Gmail users should enable the setting to always use HTTPS.

Yahoo! and Hotmail users don't have this choice and should avoid sending any financial, private or commercially sensitive information using these accounts over Wi-Fi.

Gatford said anyone using a free webmail service for business should only ever access it in public over mobile broadband using 3G USB adaptors offered by Optus, Vodafone/Three or Telstra.

He said that information transmitted over these telecommunications networks was much more difficult to intercept and copy.

Update: Google has announced that it is to standardise around HTTPS for its web mail service Gmail.


Corporate spy risks from free email
 
 
 
Top Stories
Westpac interim CIO resigns
Group CIO yet to be appointed.
 
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Pass on carbon tax savings, warns ACCC
Jul 24, 2014
The ACCC is warning businesses that supply "regulated goods" to pass on any cost savings ...
Have customers that won't pay debts?
Jul 10, 2014
The ACCC and ASIC have updated their advice when it comes to collecting debts.
Carpet cleaner faces court over online testimonials
Jul 4, 2014
The ACCC has initiated proceedings against A Whistle (1979) Pty Ltd, the franchisor of Electrodry...
You can now get 15GB of free online storage using Microsoft OneDrive
Jun 25, 2014
Cloud storage has reached both the capacity and price where it's a viable alternative to local ...
Another clever trick you can perform with Xero
Jun 25, 2014
Here is another way to reach out to particular subsets of your customers using Xero.
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  26%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 902

Vote