New loophole makes email spying easy

NEWS A newly-discovered email loophole could allow for widespread snooping of other people's online messages, adding to concerns over Internet privacy. The loophole lets an unscrupulous individual essentially "bug" an email sent to any email client that can accept HTML messages with JavaScript, a simple programming language. Such clients include recent versions of Netscape Messenger, Microsoft Outlook and Qualcomm's Eudora. The method, uncovered by US group the Privacy Foundation, requires only a few lines of JavaScript to be inserted into an email message. If the message is received by a JavaScript-enabled client, any reply containing the original message will be forwarded back to the original sender. That means, for example, that someone could send a message to a colleague, and if the message is forwarded to others, each forwarded message or reply would be copied and sent to the original sender, according to the Privacy Foundation. Even if a user turns off JavaScript, the "email wiretap" code would take effect when received by another user who had not turned off the feature. The Privacy Foundation is campaigning for email clients to be sold with JavaScript turned off as the default. The group believes spying on others' conversations could become common using this loophole. "Most of us won't release a computer virus, but this is something people would use, particularly if a service started offering it," chief technology officer Richard M Smith told the New York Times. "It's just kind of human nature." The Privacy Foundation plans to publicise its discovery Monday. They can see you... Find out how and why in Surveillance, a ZDNet News Special. Is your PC safe? Find out at the Hackers News Special Have your say instantly, and see what others have said. Click on the TalkBack button and go to the ZDNet News forum. Let the editors know what you think in the Mailroom. And read what others have said.

Post your comment

In order to post a comment you need to be registered and logged in

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Membership FAQ

ZDNet UK Live

Hey - presume you mean something that builds on Apple's existing TV device? Apple have already had a couple of runs at building Apple TV and it's...

7 minutes ago by Andrew Donoghue on Google's TV timing may reveal more to come

Google, Sony, Intel may build TV project www.zdnet.co.uk/news/emerging-tech/2010/03/18/google-sony-intel-may-build-tv-project-40088359/

39 minutes ago on Twitter by BVE2011

70,0000 to 90,0000 computers? A very small number considering some of these botnets are in the millions, and there are so many of them operating,...

1 hour ago by ator1940 on Microsoft says it decimated Waledac botnet

I agree Roger, and why can't they write secure code? What will happen when they find stolen code in windows? They have a track record of...

1 hour ago by ator1940 on Microsoft lashing out at Linux, open source

Do you think it will really take days?

2 hours ago by ator1940 on Microsoft previews Internet Explorer 9 with HTML 5 support

@evilmanic have you seen the new hp on zdnetuk

3 hours ago on Twitter by neilfab

Wonder how many days it will take before somebody codes an exploitive hack for IE9?

13 hours ago by Xwindowsjunkie on Microsoft previews Internet Explorer 9 with HTML 5 support

There are some really good people in Microsoft and I wonder, how embarassing it must be for them to see how the organisation behaves from it's...

18 hours ago by roger andre on Microsoft lashing out at Linux, open source

Great new look for ZDNET UK web-site http://bit.ly/9R5eAA to check it out @ZDNetUK #zdnet

22 hours ago on Twitter by ajclarke

Microsoft previews Internet Explorer 9 with HTML 5 support - zdnet.co.uk http://bit.ly/9FSh23

23 hours ago on Twitter by feedfrog

We were just pondering on when IE will get HTML5 and CSS3 onboard! this is excellent

23 hours ago by kencogold on Microsoft previews Internet Explorer 9 with HTML 5 support

RT @suziedaniels: relaunched www.zdnet.co.uk raises the bar yet again! its so fast it makes my eyes bleed.

1 day ago on Twitter by riptari

This is brilliant - I borrowed one and straight away saw that a few AP`s were set up to the wrong country. It gives interference levels on each...

1 day ago by Bob Preece on Fluke Networks AirCheck Wi-Fi Tester

http://www.zdnet.co.uk/news/networking/2010/03/11/european-parliament-votes-down-acta-treaty-40085614/ (Where does this leave #Debill?)

1 day ago on Twitter by _SimonArnoldme

relaunched www.zdnet.co.uk raises the bar yet again! its so fast it makes my eyes bleed.

1 day ago on Twitter by suziedaniels

Redesign complet pour ZDNet UK et AU, Twitter au centre http://www.zdnet.co.uk/ http://www.zdnet.com.au/

1 day ago on Twitter by eparody

RT @eparody: Redesign complet pour ZDNet UK et AU, Twitter au centre http://www.zdnet.co.uk/ http://www.zdnet.com.au/

1 day ago on Twitter by cdutheil

I just joined the ZDNetUK LinkedIn group http://bit.ly/aGgPhc

1 day ago on Twitter by ABridgwater

Sharepoint 2010 in photo's http://www.zdnet.co.uk/reviews/communication-and-collaboration/2010/03/04/sharepoint-2010-screenshots-40070577/

1 day ago on Twitter by gerardv

Thanks for commenting and clearing that up, Richard. We look forward to seeing what the new clause, if it is not struck out due to protests and/or...

1 day ago by David Meyer on Rights holders vs digital rights activists - who wins?

Featured white papers

Achieving PCI Compliance for:Privileged Password Management & Remote Vendor Access

e-DMZ Security

For multi-store outlets, including retail, banking, grocery, gas, hospitality, convenience stores and others, reducing (or avoiding) the cost of in-store system support and maintenance while maintaining compliance with PCI and other requirements has become a strategic challenge.

Download now

Web 2.0 Security Threats: How to Protect Your Enterprise Network

Qualys

Speaker: Dr. Chenxi Wang, Principal Analyst, Security and Risk Management, Forrester Research, Inc. As Enterprises are increasingly connected to the Internet and as hard organizational boundaries are fast disappearing, security professionals are facing fresh challenges in Enterprise computing.

Download now