Privacy group: Spying through e-mail possible

Senders of e-mail can embed JavaScript in their messages to spy on what the recipient writes when the e-mail is forwarded to third parties, a watchdog group warned Monday.

The Denver-based Privacy Foundation posted an advisory calling attention to what it calls “e-mail wiretapping,” which it says is illegal under a federal wiretapping law. The bugging works because the JavaScript commands the e-mail recipient’s computer to send a copy back to the original sender of any future versions of the e-mail, with comments added.

The snooping technology has been available for three years, but very few people knew it could be used until recently, said David Martin, professor of computer science at the University of Denver, which is associated with the Privacy Foundation.

Richard Smith, chief technology officer at the Privacy Foundation, wrote in a column attached to the advisory today that the new snooping technology “made me fall out of my chair” and called it “very illegal and also very easy to do.”

Martin said an experienced programmer with knowledge of JavaScript could “pull this off with a couple of days of work.”

But one industry analyst said he wasn’t sure the concern is that worrisome. “This e-mail wiretapping doesn’t strike me as a super-high priority for corporate users, but it could be if you are involved in sending e-mails that are potentially compromising,” said Dana Gardner, an analyst at Aberdeen Group Inc. in Boston.

For example, if you sent an e-mail with the JavaScript embedded to a boss who forwarded it on to others and added comments you could see, you might be privy to private information, Gardner said.

“It’s a sender beware kind of thing,” Gardner added, pointing out that network managers might be able to protect users by stripping out JavaScript with a manual program or disabling it.

The Privacy Foundation advisory says the spying works only when the recipient uses an HTML/JavaScript-enabled e-mail reader such as Microsoft Corp.’s Outlook, Outlook Express or version 6 of Netscape Communications Corp.’s Web browser package. Web-based e-mail systems such as Microsoft’s Hotmail automatically remove JavaScript programs from incoming e-mail messages.

Even if your machine isn’t affected, the JavaScript could be forwarded with the message and affect third parties, the Privacy Foundation said.

A Microsoft spokeswoman Monday said JavaScript is disabled by default in version 5.5 of Outlook Express, and it can be disabled with a security update for Outlook. The JavaScript can be disabled manually by going to the “Tools” menu in the task bar, then “Options” and then “Security” in the Outlook toolbar, she said.

The foundation details a longer, 15-step method in its advisory.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now