Senders of e-mail can embed JavaScript in their messages to spy on what the recipient writes when the e-mail is forwarded to third parties, a watchdog group warned Monday.
The Denver-based Privacy Foundation posted an advisory calling attention to what it calls “e-mail wiretapping,” which it says is illegal under a federal wiretapping law. The bugging works because the JavaScript commands the e-mail recipient’s computer to send a copy back to the original sender of any future versions of the e-mail, with comments added.
The snooping technology has been available for three years, but very few people knew it could be used until recently, said David Martin, professor of computer science at the University of Denver, which is associated with the Privacy Foundation.
Richard Smith, chief technology officer at the Privacy Foundation, wrote in a column attached to the advisory today that the new snooping technology “made me fall out of my chair” and called it “very illegal and also very easy to do.”
Martin said an experienced programmer with knowledge of JavaScript could “pull this off with a couple of days of work.”
But one industry analyst said he wasn’t sure the concern is that worrisome. “This e-mail wiretapping doesn’t strike me as a super-high priority for corporate users, but it could be if you are involved in sending e-mails that are potentially compromising,” said Dana Gardner, an analyst at Aberdeen Group Inc. in Boston.
For example, if you sent an e-mail with the JavaScript embedded to a boss who forwarded it on to others and added comments you could see, you might be privy to private information, Gardner said.
“It’s a sender beware kind of thing,” Gardner added, pointing out that network managers might be able to protect users by stripping out JavaScript with a manual program or disabling it.
The Privacy Foundation advisory says the spying works only when the recipient uses an HTML/JavaScript-enabled e-mail reader such as Microsoft Corp.’s Outlook, Outlook Express or version 6 of Netscape Communications Corp.’s Web browser package. Web-based e-mail systems such as Microsoft’s Hotmail automatically remove JavaScript programs from incoming e-mail messages.
Even if your machine isn’t affected, the JavaScript could be forwarded with the message and affect third parties, the Privacy Foundation said.
A Microsoft spokeswoman Monday said JavaScript is disabled by default in version 5.5 of Outlook Express, and it can be disabled with a security update for Outlook. The JavaScript can be disabled manually by going to the “Tools” menu in the task bar, then “Options” and then “Security” in the Outlook toolbar, she said.
The foundation details a longer, 15-step method in its advisory.