Privacy group: Spying through email possible
- 07 February, 2001 22:00
- Senders of email can embed JavaScript in their messages to spy on what the recipient writes when the email is forwarded to third parties, a watchdog group warned this week.
The Denver-based Privacy Foundation posted an advisory calling attention to what it calls "email wiretapping," which it says is illegal under a federal wiretapping law. The bugging works because the JavaScript commands the email recipient's computer to send a copy back to the original sender of any future versions of the email, with comments added.
The snooping technology has been available for three years, but very few people knew it could be used until recently, says David Martin, professor of computer science at the University of Denver, which is associated with the Privacy Foundation.
Richard Smith, chief technology officer at the Privacy Foundation, wrote in a column attached to the advisory that the new snooping technology "made me fall out of my chair" and called it "very illegal and also very easy to do."
Martin says an experienced programmer with knowledge of JavaScript could "pull this off with a couple of days of work."
But one industry analyst says he wasn't sure the concern is that worrisome. "This email wiretapping doesn't strike me as a super-high priority for corporate users, but it could be if you are involved in sending emails that are potentially compromising," says Dana Gardner, an analyst at Aberdeen Group in Boston.
For example, if you sent an email with the JavaScript embedded to a boss who forwarded it on to others and added comments you could see, you might be privy to private information, Gardner says.
"It's a sender beware kind of thing," Gardner adds, pointing out that network managers might be able to protect users by stripping out JavaScript with a manual program or disabling it.
The Privacy Foundation advisory says the spying works only when the recipient uses an HTML/JavaScript-enabled email reader such as Microsoft's Outlook, Outlook Express or version 6 of Netscape Communications' web browser package. Web-based email systems such as Microsoft's Hotmail automatically remove JavaScript programs from incoming email messages.
Even if your machine isn't affected, the JavaScript could be forwarded with the message and affect third parties, the Privacy Foundation says.
A Microsoft spokeswoman says JavaScript is disabled by default in version 5.5 of Outlook Express, and it can be disabled with a security update for Outlook. The JavaScript can be disabled manually by going to the "Tools" menu in the task bar, then "Options" and then "Security" in the Outlook toolbar, she says.
The foundation details a longer, 15-step method in its advisory.