Send Anonymous Email | Stealth Internet Rotating Header Image

September 22nd, 2008:

Data Privacy Still Compromised Due to Encryption Legacy Perceptions, Lack of Awareness and Understanding

CertifiedMail, Inc., a leading global provider of secure messaging solutions and Osterman Research, Inc., a leading market research and consulting firm in the messaging and collaboration space, today announced the results of a recent study entitled “Joint Research Report: Encryption Solution Implementation Landscape.” The findings indicate that data privacy is still compromised due to encryption legacy perceptions, a lack of awareness regarding the availability of easy to use solutions, as well as a lack of understanding of the type of data that needs to be encrypted.
“The consequences of not encrypting sensitive content such as financial data, trade secrets, login credentials, information on potential mergers and acquisitions, means this data is open for any hacker to view and disseminate,” said Kelly Mackin, COO and President of CertifiedMail, Inc. “Many organizations can experience loss of revenue and reputation if their confidential communications are made public and many organizations can lose crucial data and not even know it before it’s too late. We are at a point in time where no one questions the validity or need for anti-virus or anti-spyware. We need to make the next leap in educating businesses that the ability to conduct confidential on-line business is readily available today.”
“The results of this survey clearly indicate what organizations should do to protect their confidential data and their organizations from financial and other harm,” said Michael Osterman, President, Osterman Research, Inc. “Companies need to deploy an easy-to-use encryption capability that will allow users to encrypt private content, even content that is only mildly sensitive. This will ensure that organizations are protected from the potential loss of sensitive information that could come back to harm them.”
CertifiedMail and Osterman Research conducted an online survey of 205 small, mid-sized and large organizations in North America and Europe. The mean number of employees and email users at the organizations surveyed was 13,257 and 11,119, respectively. Respondents came from a wide range of industries, including manufacturing (18%), financial services (14%), government (11%) and healthcare (8%).
Key Findings
Of the 205 enterprises surveyed:
— 47% do not have the ability to send encrypted email directly from their desktop.
— Only 45% can send encrypted email manually through their email client.
— Only 13% can send encrypted emails automatically through some sort of policy-based encryption capability.
— Osterman Research found that 27% of organizations had experienced an accidental or malicious data leak during the previous 12 months.
— Among those respondents that can send a manually encrypted email, 22% found doing so somewhat difficult or difficult, while another 44% consider sending encrypted email manually to be “not too difficult”. Much of the belief that encrypted email is generally difficult to use arises from the legacy of difficult-to-use, difficult-to-manage and expensive infrastructures that were not scalable and caused other problems. While today’s encrypted email systems are substantially easier to use than early-generation systems, the legacy continues to hold true for many decision makers.
— The market of frequent encrypted email users — those who would be the primary drivers for the adoption of encrypted email in most organizations — comprise 18% of total email users. Occasional users, comprise another 31% of users, while infrequent users comprise the remaining roughly one-half (51%) of users.
— Survey respondents indicated that if encrypting an email could be accomplished by simply clicking a button in the email client, “infrequent” users would likely use encryption frequently for all types of communications, even those that contained only moderately sensitive content. Nearly one-half of users want to have automatic encryption capabilities.

Should spammers have legal protections for what they do?

In the wake of the recent Virginia Supreme Court ruling overturning the conviction of spammer Jeremy Jaynes, there is a firestorm of controversy now building online. The heart of the matter is that the ruling centered on the wording of the 2003 Virginia law, calling it “unconstitutionally overbroad,” which, while protecting the U.S. First Amendment, also allowed a spammer to wriggle off the hook. So, was the court correct in its decision?

Freedom of speech is something people have died and fought for since its inception. The First Amendment of the U.S. Constitution ensures that any U.S. citizen is given the right to speak, write, and say anything they want when expressing an opinion. You may not agree with what they say, but it is their right to say it.

There are a few limits to freedom of speech however, such as shouting “FIRE!” in a crowded building or making direct threats to a person with the intent to frighten or coerce them into your line of thinking — to name but two. Yet, the fact remains that most forms of communication are protected and some are taking the stance that spammers are equally protected as well, simply because of the wording used in the recent ruling handed down by the Virginia Supreme Court.

The ruling, which has caused much debate and commentary, focuses on the 2004 conviction of spammer Jeremy Jaynes. In a nutshell, while Jaynes did not contest the accusations made against him with regard to sending Spam, his appeal now centers on the wording in the Virginia law that make it illegal to send e-mail with false routing and header information.

The Virginia law makes it a felony and mandates jail time should a person send more than 10,000 e-mails within 24 hours or 100,000 within a rolling 30-day period. Also, if the e-mails resulted in profit for the sender ($1000 USD or more) then additional charges can also be filed.

However, Virginia Justice G. Steven Agee said that the law, “prohibits the anonymous transmission of all unsolicited bulk e-mails including those containing political, religious or other speech protected by the First Amendment.”

Agee also made the connection to sending The Federalist papers over anonymous e-mail. “For example, were the Federalist Papers just being published today via e-mail, that transmission by PubliAus would violate the statute.”

Thus you have the heart of the matter; namely the Virginia law is missing selective wording that outlines what types of e-mail would be protected and what would be considered a violation. Specifically, because Jaynes’ case used the present form of the law as it stood to convict him, it would appear to have violated his First Amendment rights.

The Virginia Supreme Court rejected arguments that the Spam law was a trespass law aimed at protecting the e-mail servers of large ISPs and private companies. The rejection is because of the removal of the right to hide information, such as the originating network where the e-mail was sent from (IP spoofing), or the return address. Spoofing e-mail headers is a well-established trick and the law should make it illegal to do so, as it does in some cases, but the court argues that doing so should not infringe on the First Amendment.

“Because e-mail transmission protocol requires entry of an IP address and domain name for the sender, the only way such a speaker can publish an anonymous e-mail is to enter a false IP address or domain name,” Agee wrote.

Lawyers and experts have subsequently come out of the woodwork, on top of the expressive comments made by normal Internet citizens, to vent their frustrations against the ruling. Most of the comments centered on the ruling’s mention of political expression over commercial e-mail. Since the Virginia law never separated the two, they are considered equal under the statute.

This is not true, but that is the danger the court sees. Thus it reversed Jaynes’ case. However, another interesting twist is that the court upheld the very same laws it recently reversed only six months ago. So this ruling reversed its entire stance on the issue.

Jon Praed, an attorney with Arlington-based Internet Law Group, told the Washington Post that: “Every kindergartner learns the idea of keeping your hands to yourself. Does the Constitution really require us all to post ‘No Trespassing’ signs on our homes — or our mail servers — to remind the world the dwelling isn’t open to the public and the mail server is not a soapbox to be used and abused by anyone who thinks they have something to say?”

Virginia Attorney General Bob McDonnell said he plans to appeal the ruling. “Today, the Supreme Court of Virginia has erroneously ruled that one has a right to deceptively enter somebody else’s private property for purposes of distributing his unsolicited fraudulent emails. I respectfully but fervently disagree. We will take this issue directly to the Supreme Court of the United States. The right of citizens to be free from unwanted fraudulent emails is one that I believe must be made secure.”

Again, the wording of the law is what is in error. This is what the court centered on. Yet, there are several methods to prevent “unsolicited fraudulent emails,” as Spam blocking is all the rage in corporate and home security solutions.

Jaynes is a spammer. However, did Justice G. Steven Agee do the right thing? Was this law a knee-jerk reaction from local lawmakers and poor policy drafting? Should spammers be afforded the same protections as political activists if they mix Spam and politics in the same e-mail?

Where do you stand on the issue? Feel free to sound-off below.

Intermedia Gives Free Email After Ike

In an effort to help corporations struck by disaster, business email and collaboration Software as a Service provider Intermedia (intermedia.net) has announced a free business-class email program for corporations affected by Hurricane Ike, which landed in Texas on the weekend, wreaking US damages of an estimated $27 billion.

 

According to an announcement this week, Intermedia’s business email continuity program is designed to help office-based messaging services disrupted by the storm. The program is designed to enable businesses to re-establish communication with customers, vendors and partners in order to keep their businesses running.

 

“Everyone is trying to help those impacted by the hurricane in Texas any way they can,” Intermedia chief executive officer Serguei Sofinski said in a statement. “Intermedia can help the affected business community with free business email services that will help keep their business in operation, even if their work location has been damaged or destroyed.”

 

Prior to announcing the free email program, New York-based Intermedia donated to the Red Cross Disaster Relief fund.

 

One in five organizations believe a single, major email outage could result in revenue losses of up to half a million dollars, according to a survey by Osterman Research (ostermanresearch.com). Management consults at Eagle Rock Alliance (eaglerockalliance.com) estimate as many as 40 percent of companies that go more than a day without access to their data go out of business.

 

To mitigate this risk, Intermedia is offering its Microsoft Exchange 2007-based hosted email solutions in both small business and enterprise versions. Participants will have full access to the email system free of charge until October 31.

Why the Palin Hack Could Happen Again and Again

How can you prevent a Palin webmail hack from happening to you? The short answer: you can’t.

 

Yahoo has no immediate plans to overhaul its e-mail security procedures after a hacker last week gained access to Sarah Palin’s private Yahoo Mail account, the company said Monday. Instead, it is reviewing security processes on an industry-wide basis.

 

Google’s Gmail and Microsoft’s Hotmail also have existing processes in place to enable password recovery. But those too can be exploited by a hacker patient enough to sniff through personal data that might already be available online.

 

Yahoo, however, is being forced to reconsider its own security practices.

 

“While federal law and our privacy policy prevent us from commenting about specific user accounts, Yahoo takes security and privacy seriously and we are continually working on improvements to our account security processes,” according to a spokeswoman. “We’re also participating in industry-wide discussions on how to better protect users.”

 

A hacker gained access to the Republican vice presidential hopeful’s gov.palin@yahoo.com account last week after successfully navigating Yahoo’s password recovery feature. That process required the hacker to enter Palin’s login name, date of birth, ZIP code, and to answer the question, “Where did you meet your spouse?”

 

Palin, who currently serves as governor of Alaska, is now widely known to be a lifetime resident of Wasilla, Alaska, so the ZIP code was easily deciphered. A quick Google search revealed her date of birth, and any of the approximately 40 million people listened to her GOP convention acceptance speech were informed that she met her husband in high school. An amateur who fiddled with the wording a bit – “Wasilla high” being the correct response – had access within minutes.

 

Yahoo is trying to strike a balance between providing a secure user experience while also ensuring a process for accessing lost account information, according to a source familiar with the situation. The company last week issued a memo to users on how to create more secure passwords, though the Palin hacker did not know her password.

 

Naturally, a typical user’s personal Webmail accounts are not going to generate as much hacker interest as Palin’s account, but security remains a concern. What is your best option?

 

When signing up for Yahoo, the company asks for standard personal information – name, gender, date of birth, country, and ZIP code – and then asks users to answer one of nine possible secret questions: where the user met his or her spouse; the first school the user attended; his or her childhood hero, favorite pastime, favorite sports team, father’s middle name, or high school mascot; the name of the user’s first car or bike; or the name of the user’s pet.

 

Once you select one of these questions, however, you cannot change it. You can also not change your date of birth. Had Palin recovered her own account, hackers could have just as easily gained re-entry given that they had the answer to her secret question. Yahoo does allow users to change their gender and/or location, so switching her ZIP code to a random city might have done the trick.

 

Microsoft’s Hotmail has a similar set-up situation, asking for personal information, and the answer to one of six secret questions: the user’s mother’s birthplace, the user’s best childhood friend, the name of the user’s first pet, the user’s favorite teacher, favorite historical person, or the occupation of the user’s grandfather.

 

Unlike Yahoo, Hotmail users can change their secret question once they set up their account. This might have helped Palin if she’d acted fast, but it also means that if the hacker had successfully accessed a Hotmail account, the hacker could have changed the secret question immediately and locked the proper owner out of the account indefinitely.

 

Microsoft also has no immediate plans to change its Hotmail security processes, according to a spokeswoman.

 

“Microsoft is always working to strengthen the security of its products and services and is committed to helping consumers have a safe, secure and positive online experience,” she said. “We know our customers’ needs are constantly evolving based on changes in the security landscape and we are always working to meet these new threats and to help protect our customers from them.”

 

Gmail might have the most secure password recovery process at this point, but it is a potentially lengthy process.

 

Gmail also requires personally identifiable information, but lets users either create their own question or answer one of four Google-selected questions: primary frequent flyer number, library card number, first phone number, or first teacher’s name.

 

If a user forgets his or her password, Google will send password reset information to the secondary e-mail address a user provided when signing up. But if the user lost the password to that account, no longer had access to it, or did not provide a second e-mail address, Google requires a waiting period of five days before resetting the password.

 

“To prevent someone from trying to break into an account you’re actively using, the security question is only used for account recovery after an account has been idle for five days,” according to Google. “The Gmail team cannot waive the five day requirement or access your password under any circumstances.”

 

The FBI and Secret Service are now investigating the Palin hack. Authorities reportedly searched the home of a 20-year-old University of Tennessee student over the weekend, but no arrests have been made. The hacker could face felony charges for violating the Computer Fraud and Abuse Act, but could also avoid prosecution thanks to a Department of Justice loophole, according to the Electronic Frontier Foundation.

 

Palin and the now erased Yahoo account have also made headlines over allegations that the governor used her personal account for state business.

Cyber crooks set email trap with bogus Obama sex video

Cyber crooks are trying to cash in on fascination with the US presidential race by sending trick email promising a sex video starring candidate Barack Obama, according to Sophos computer security firm.

Email recipients gullible enough to click on an enclosed link get to see a seemingly homemade sex video that doesn’t feature the presidential contender but does secretly install malicious software on people’s computers.

“This email has been spammed out widely across the Internet, claiming that US senator Barack Obama has been in a sex video while he was in the Ukraine and all you have to do is click on the link to view the movie,” Sophos technology consultant Graham Cluley said in a video posted on the firm’s website.

“If you were to click on that link … spyware is installed on your computer which steals your passwords and your banking information and sends it to cyber criminals.”

Ill-intended creators of malicious software are quick to seize on hot topics to dupe people into opening files or executing applications that allow stealth programs to invade their machines.

The tactic is referred to as “social engineering” because it involves fooling computer users instead of hacking past security software or firewalls guarding systems.

Ruses have involved sending bogus emails promising images or video of celebrities or from major disasters such as earthquakes, tsunamis or hurricanes.

“So next time you receive an unsolicited email don’t just blindly click on it,” Cluley advised. “You could be getting into danger.”