Note from d.f.i.cameron:

Re. Hotmail security breach: cybersurveillance, hacking...and the likelihood that someone else is reading this...
-------

To see this story with its related links on the News Unlimited site, go to http://www.newsunlimited.co.uk

You've got mail (and anyone can read it)
News that hackers have steamed open the virtual envelope of email has rocked the online world. With everything from sensitive business memos to digital love letters vulnerable to prying eyes, and even the mighty Microsoft exposed, do we have any privacy left? Victor Keegan reports<br><br>
<a href="http://www.newsunlimited.co.uk/more_about/0,5167,78202,00.html" target="_new">Links, reports and background: more about privacy on the net</a>
Tuesday August 31 1999
The Guardian


The revelation that Microsoft's Hotmail - used by more than 50m email subscribers - has been hacked into sent reverberations around the entire internet community yesterday. It was seen not only as the biggest security leak in the internet's (admittedly brief) history but as a wake-up call to all those naive net users who thought that the information revolution was about giving information to us rather than to them. 

Its importance cannot be underestimated because of Microsoft's position. Its operating system controls over 90% of the world's personal computers and it is the largest company in the world in terms of stock market valuation. Every time punters use Hotmail they see a notice boasting about Microsoft's commitment to privacy. People are asking the obvious question: if Microsoft with its amazing resources can't prevent an easy three-step hacking procedure that gives access to someone else's email, then is anything safe?  

The answer for most people unfamiliar with sophisticated encryption devices is No.  

The digital revolution has certainly brought about a more open society. We have unprecedented access almost instantaneously to a vast treasure trove of information. But the downside of the revolution is that we have created a culture in which what we do or write is available to anyone with the time or ingenuity to find out.  

We walk to work under the gaze of numerous CCTV cameras recording bits of our lives: we have to use a swipe card before entering work where all our telephone calls are recorded and emails stored not just on our own computer terminals but on back-up disks for the company's records. Even if we erase them they are still stored on a back-up disk. 

When we browse the world wide web at work we leave traces that company executives can easily gain access to if they need to. Meanwhile our mobile phones send out regular signals from wherever we are, providing another record of our movements. Big Brother is not just watching us from a hidden camera. He is everywhere. The funny thing is that no one seems to mind. Or, at least, they didn't until this week when the world's mightiest software company was hacked.  

Email, seasoned net users will tell you, shouldn't be used for anything you wouldn't put on a postcard. Why? Simply because it is almost like public property - as a string of recent cases will attest to. It never occurred to Monica Lewinksy that her private emails to Linda Tripp would end up published for the whole world to read any more than Bill Gates expected private internal emails at Microsoft to be subpoenaed by the anti-trust authorities for their case against Microsoft four years later.  

When an email is written it is dispatched in separate electronic packages (via telephone lines or satellites) around the world before arriving at its destination, leaving lots of potential interception points - plus a copy on the service provider's own computer.  

Email sent through Hotmail differs from most other emails because it is routed through the internet. This means that (unlike mail sent from most offices or homes) it can be accessed wherever you are in the world as long as you can get the internet. The explosion of internet cafes around the world, including the world's biggest outside Victoria station (with 400 terminals), can be traced directly to web-based email services such as Hotmail and Yahoo. They have become a backpacker's paradise. 

But convenience comes at a price. They are much easier to hack. Even if you bother to take a popular encryption programme like PGP (Pretty Good Privacy) with you to assure confidentiality it is unlikely that a cafe in, say, South America will let you load the software to make use of it.  

Ironically, the entrepreneurs who started up Hotmail (before Microsoft bought it for a reported $400m last year) devised it partly as a way of corresponding with each other in their previous employment without their bosses knowing. One of their early slogans was "email your boss can't read".  

That was true in the sense that by using the internet you could avoid all the surveillance mechanisms set up by your employer, but it doesn't mean that it is secure in itself. Indeed, web-based services such as Hotmail have been blamed for viruses that are imported into otherwise secure corporate networks by outside mail. 

Star Internet, a company that scans computer systems for viruses, said yesterday that a vast number of viruses were originating from people using Hotmail accounts to send CVs to their prospective employers. This has a knock-on effect on corporate security since email originating from the web bypasses any corporate security or anti-virus protection.  

Is anyone safe? Caspar Bowden, director of the Foundation for Information Policy Research said yesterday: "This massive security breach illustrates that server-side vulnerabilities arising from the hectic pace of innovation mean web-based email services may be less secure than email delivered to your machine." He warned: "Even if a web-mail service purports to use encryption, there are still server-side weaknesses that could potentially be exploited."  

One of the key differences between web-based email and others is that your web-based email remains "online" in cyberspace for a long time (maybe in a computer in America or Australia) waiting to be hacked whereas most conventional service providers delete messages from their own storage computers after the message has been (hopefully) downloaded to the safety of your hard disk at home.  

But even dial-up accounts can be hacked. Paul Cronin, who works for Centurycom, an ethical company that scans and hacks into company and other systems to test their security, claimed yesterday that hardly anyone was invulnerable, even those with non web-based service providers using POP (Post Office Protocol) servers. This was because in nine cases out of 10 people used passwords based on their loved ones, or football teams or dogs or something else familiar.  

His company has compiled an electronic dictionary to include such likely names as well as ordinary words. It can then be plugged into a POP user access or news service to run through all likely combinations in a short period of time. He reckons that in nine cases out of 10 he can "compromise" the user's security (ie hack in) even if it is a company that has taken trouble to protect its own security. With individuals who haven't bothered to protect their access he reckons to have a 100% hit rate.  

There are several lessons from all this. If you are using email for pleasure then you shouldn't write anything that might seriously embarrass you if it sees the light of day. This is true with bells on in offices because email ultimately belongs to the company. A typical corporation will argue that it pays for the computers and the telephone time and managers regard audit trails of emails and telephone calls as a legitimate tool to stamp out abuse (like emailing friends all day instead of working or surfing the web for pornography).  

The lesson for business users is to avoid, for the moment, using web-based email for commercial transactions and to use reputable encryption for anything confidential. But even this is not always secure as every new encryption process claimed to be secure produces a challenge for hackers (and criminals) all over the world.  

And the security services are not disinterested either. In Britain there is pressure from the police and the home office for ISPs (internet service providers) to keep all email and chat for up to six months in case it is needed for investigative purposes. Service providers are resisting strongly, partly for reasons of civil liberties but more especially because the storage space needed would be horrendously expensive. 

Computers at the US National Security Agency are reported, although this is unconfirmed, to be able to search through every word that flies through cyberspace. It is unlikely that this extends to the latest "uncrackable" encryption codes employing very large prime numbers. But, in any case, these are not on tap for the ordinary Hotmail user who seems condemned to be writing for potential publication. If anyone knows of a solution they should write to the relevant authorities. On a postcard.

<B>Beating the snoopers: what you can do</B>

Microsoft claims to have fixed the security flaw that exposed 50m Hotmail users' private email to unauthorised eyes. But Hotmail, the internet and Microsoft's computer programs are still littered with loopholes. Here are some simple things you can do to guard your privacy online.   

&#149; <B> Avoid web-based email services</B> 

They use standard browsers such as Internet Explorer and Netscape. For new users, they can seem an easier start, but they are easier to break in to. For better security, select an ordinary internet service provider which provides a standard email service with a separate email programme.  

&#149; <B> Pretty Good Privacy</B>

The most commonly-used encryption programme is PGP, or "Pretty Good Privacy" (<A HREF='http://www.pgpi.org' TARGET=_NEW>www.pgpi.org</A>). It's free to domestic users, runs on most common operating systems, and will integrate itself seamlessly into popular email programmes such as Eudora or Outlook Express. Once a message is written, PGP scrambles it using the published "public key" of the intended recipient. Only that person can then read the message when it arrives; to anyone else it's a meaningless jumble of letters. To start using PGP, you create your own pair of keys one for encrypting and the other for decrypting. Publicise the encrypting key to the people you correspond with, or to the world generally, and your mail can be sent scrambled. Security experts can steal PGP information but for most people who simply want an electronic envelope around their personal mail, PGP is a sufficient solution.    

&#149; <B> Hushmail</B> 

The name is a play on the Hotmail service. But mail sent to and from Hushmail's free web service (<A HREF='http://www.hushmail.com' TARGET=_NEW>www.hushmail.com</A>) is automatically encrypted as it arrives. While stored on the Hushmail web server, it is unreadable. So even if Hushmail's computers were as vulnerable as Hotmail's, there would be nothing intelligible for an intruder to see and understand. But email could still be read on its way into Hushmail, unless separately encrypted.  

&#149; <B> Freedom</B>   

Designed by Zero Knowledge Systems (<A HREF='http://www.zeroknowledge.com' TARGET=_NEW>www.zeroknowledge.com</A>), this is a new kind of internet service. Its Canadian designers were concerned that privacy didn't begin and end with the contents of email messages. They wanted to protect net users from all kinds of surveillance, such as snooping on what websites they visited. Freedom stops that not just by encrypting messages but by turning everyone's identity into digital pseudonyms. Different pseudonyms allow you to separately explore completely different areas of the internet and avoid being profiled by internet marketers, they claim, and no one - not even Zero-Knowledge Systems - will be able to find out who is behind a digital identity.  

&#149; <B> New standards, new loopholes </B>

Because the whole of next century's e-commerce will depend on encryption methods for security and identification, cryptography is now essential at the heart of every computer. Microsoft have created a standard program for doing this, CAPI. But you can't have the high-security version of CAPI unless you are in North America. For everyone else, loopholes and low security are built-in features, to help US intelligence agencies gather information. The problem is that when loopholes are built in for companies, law enforcement or intelligence agencies to exploit, other people find them. - Duncan Campbell  

Copyright Guardian Media Group plc.
--- End Forwarded Message ---


----------------------
Nicole D. Matthews
[log in to unmask]



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%