New Nokia Smartphones Leak E-mail Passwords

Noksu writes "Despite of the recent plunge in Nokia's profits, the company is doing well in the surveillance business. The infamous 'Lex Nokia' got ratified in Finland and the company has launched a massive Nokoscope research project for data gathering. In the meantime Nokia's new smartphones forward e-mail account credentials to a remote server. Surprisingly enough, this is done in HTTP request headers. The company has been informed, but there has not been an official statement yet. Time for class action suit in the US?"

Comments

Solution:

[forkazoo]

Don't use 'GET /', 'HTTP/1.0', or 'user-agent' as your password, and you will be much less likely to have your password submitted automatically by an HTTP client program.

Re:Solution:

[0100010001010011]

Hell, what if you use a ?, & or a # in your password? Something tells me they probably didn't do a url encode.

Although you could have some fun with dumb snoopers out there.

Just make your password:

https://ccds.serviceactivation.ext.nokia.com:443/api/v1/rest/?operation=ccds.provider.determineAccount&applicationCode=email&
address=test.user@mycompany.com&password=topsecret&
mcc=244&mnc=91&carrier=sonera

So the request would be:
https://ccds.serviceactivation.ext.nokia.com:443/api/v1/rest/?operation=ccds.provider.determineAccount&applicationCode=email&
address=test.user@mycompany.com&password=https://ccds.serviceactivation.ext.nokia.com:443/api/v1/rest/?operation=ccds.provider.determineAccount&applicationCode=email&
address=test.user@mycompany.com&password=topsecret&
mcc=244&mnc=91&carrier=sonera&
mcc=244&mnc=91&carrier=sonera

Re:Solution:

[tritonman]

After reading the article, it doesn't seem that it uses the HTTP headers, it appears to use actual URL parameters, which is probably 100x worse. Either way, if it sends plain text passwords, that's just idiotic.

Re:Solution:

[janeuner]

In the clear? No.

In apache access logs? muahahah....

Response from Nokia

[GuldKalle]

Nokias response

Non-issue?

[TrebleJunkie]

This isn't really an issue, is it?

Yes, it sends credentials through to Nokia, but it does _not_ use an un-encrypted HTTP connection to do it. It uses SSL/HTTPS. It's also _not_ done in HTTP Header messages, it's going through in the GET request.

*shrug*

Re:Non-issue?

[Nos.]

I guess Nokia getting your email account credentials isn't an issue for you.

Re:Non-issue?

[InsertWittyNameHere]

If you setup an email on your Blackberry with BIS (not BES) then RIM has your credentials.

Why is it an issue now with only Nokia?

Re:Non-issue?

[InsertWittyNameHere]

Basically their (RIM, etc) server will check for email, download it, compress it, then push it to your device.

So if you have 10 email accounts rather than your device constantly checking each one, wasting data and battery life, the server does all that work and you get push email functionality.

Re:Non-issue?

[Sethb]

This is the way BIS works. The reason you get great battery life out of a Blackberry is that RIM's server is hitting your POP/IMAP server and checking for mail, then it just pushes it to your Blackberry as needed. Compared to running a Windows Mobile phone with your IMAP connection being live all day, the battery & traffic savings are enormous. The downside is that you have to share your username & password with RIM, unless you're using BES, which is what enterprises who worry about giving out their passwords do...

Re:Non-issue?

[causality]

If you setup an email on your Blackberry with BIS (not BES) then RIM has your credentials.

Why is it an issue now with only Nokia?

That's a good question. I'll give you my best guess at an answer, though a guess is all that it is.

I should say up front that I don't know very much at all about Blackberries. I will assume that what you said is correct, that a Blackberry with BIS presents the very same privacy issue because it shares username/password credentials with a third party. Thus, the privacy issues posed by predecessors like the Blackberry can be viewed as a mistake or at least as less-than-optimal. If it's a mistake, then there is no good reason why Nokia could not have learned from this previous example and designed their system in such a way that no third parties need to be trusted with confidential information.

It should be possible to equip the phone with a standard POP3/IMAP e-mail client. Logically, if a phone can have a Web browser it can also have such an e-mail client. Then the login credentials can be stored in the phone itself and the phone can use APOP, TLS, or SSL to communicate securely with the e-mail server. Then Nokia is merely the carrier and has no reason to ever see anyone's login credentials and those credentials are safe(r) from other eavesdroppers because they are not sent as plaintext. If these new Nokia phones could do that, then that would represent an improvement on the earlier example of the Blackberry.

The thing I don't understand is why anyone would ever design the system in such a way that a third party needs to be trusted with confidential information. It seems unnecessary. What benefit does this provide that absolutely cannot be arranged by an independent e-mail client that stores such information locally on the phone? I suppose that same question can be rephrased as "does server-push provide any benefit that client-pull with a reasonable polling time could not also provide?"

Re:Non-issue?

[Binestar]

The thing I don't understand is why anyone would ever design the system in such a way that a third party needs to be trusted with confidential information. It seems unnecessary. What benefit does this provide that absolutely cannot be arranged by an independent e-mail client that stores such information locally on the phone? I suppose that same question can be rephrased as "does server-push provide any benefit that client-pull with a reasonable polling time could not also provide?"

Battery life. By having the Blackberry server push the email to your blackberry you save the battery time and bandwidth of checking your email every 10-15 minutes.

If you don't want them to have your password get a BES.

It starts to become a does $.002 == .002cents question.

Re:Non-issue?

[ivucica]

IMAP, on a properly written client, in online mode, keeps the connection open and the server notifies the client when new messages arrive.

Re:Non-issue?

[digitalchinky]

This article is news, you are having comprehension issues. The article writer is not using or wanting a proxy to handle email.

The short version, since you missed it.

* Built in mail client set up wizard = spyware (And since there is no other method to create an account, how do you propose one avoid it?)

When I set up thunderbird to talk to MY imap/pop server, I don't expect it to go off and give my authentication details to Mozilla.
When I set up my phone in exactly the same way, I don't expect it to hand out my authentication info to Nokia.

Thunderbird doesn't do this. Nokia does. How is that not news? The system you are talking about is entirely different to the one the author is describing.

Re:Non-issue?

[Anonymous Coward]

I know very well how Nokia Messaging works because I use it. This is their new email client that is now being shipped on recent higher-end phone(s), or that can be downloaded/installed on older models. It is made to compete with Blackberry services which work the same way.

You can complete its setup over the web - you go to http://email.nokia.com/ enter IMAP/POP server name/username/password and add up to 10 accounts to your main Nokia account.

Alternatively, you can do these steps on the phone itself, which is what the OP described.

You then run Nokia Messaging on your phone, enter your master credentials and have access to all of your accounts.

This is how this service is designed. You may think it's not prudent to give Nokia your credentials, but this is how this service is designed and there are reasons for doing it this way.

Claiming there is some conspiracy is silly.

A few details I forgot:

[Anonymous Coward]

Subby here: To clarify some things: this issue is on Nokia Messaging client. The only device (AFAIK) that currently ships with Nokia Messaging is E75. The older models use the old email/messaging software, that has nothing to do with Nokia Messaging service.

I haven't checked how Nokia markets the Nokia Messaging service/client nowadays, but originally it was marketed as a service (the email proxy) and accompanying client, and you couldn't even use the client without the proxy service.

Apparently this has changed now when E75 ships without the original standalone email client.

So, E71 (or any other Nokia phone except E75) does not have this issue unless you have downloaded the separate Nokia Messaging software and use that for reading mail.

Re:A few details I forgot:

[GuldKalle]

According to the bloggers followup, at least three models are affected:
5800 (20.0.0.12)
N79 (11.049)
E75 (110.48.78)

Also from the followup:
Yes, I know there is a solution called Nokia Messaging (read more from here), but maybe I wasn't clear enough in my initial post: I am configuring direct IMAP/POP access to my own/company/organization/whatever email service and I am not using nor planning to use Nokia's messaging proxy.

Re:A few details I forgot:

[Progoth]

I'm on the server software team, so I'm not completely sure about the client - but as I understand it, the client's hitting our CCDS server to save you the step of putting in server names / ports /etc. The service was written for Nokia Messaging, and is used there, but is also valid for the client to configure its built-in client.

/just finished implementing push, non-POP Hotmail support for Nokia Messaging not too long ago

sneaky..

[Keruo]

Good thing my email password is ";drop database;"

Re:sneaky..

[idontgno]

Bobby Tables, is that you?

sounds like

[Presto Vivace]

they're not very smart phones.

Re:sounds like

[Sockatume]

I mentally inserted a Horatio sunglasses moment between your post title and the content.

Re:An issue.

[GuldKalle]

nope.
At least that was very clearly not his intention

Re:More amateurish BS from Nokia

[Anonymusing]

The new "Mail by Nokia" system is hilariously crappy. They want you to give them the logins to your mail accounts, then they retrieve your email. Why would anyone do this?

Probably for the same reason that people let Gmail do this.

How else to do push email?

[Elwood P Dowd]

As commenters have already pointed out on those blog posts, push IMAP will require that Nokia stores your credentials on servers that check for your new email as a proxy.

This request is https. If, during setup, you asked for push IMAP, or any number of other imaginable features for your mail account, sending your credentials to a Nokia or wireless carrier server will be necessary.

Actually... if it's https... how the hell can this guy tell what the URL request is? Has he patched their email client to snitch?

Re:How else to do push email?

[godel_56]

This request is https. If, during setup, you asked for push IMAP, or any number of other imaginable features for your mail account, sending your credentials to a Nokia or wireless carrier server will be necessary.

Not only have you not RTFA but you haven't bothered to read the previous Slashdot comments. He is NOT using push email and he intercepted the communications on his own network using Webscarab and Wireshark. Nokia are only providing the comms terminal and have neither the need or the right to know his password or account details.

Re:An issue.

[Culture20]

it is still not such a big deal.

Not a big deal to have your credentials sent to a third party? What if Nokia's wizard used a Finnish government server instead?
What if a Chinese-made phone was sending username/password to a Chinese government server?
What if Antti Järjestelmävalvojanen, a (fictitious) Nokia network admin, starts storing them on his thumb drive?

Class action suit?

[PCM2]

A class-action lawsuit? Seriously?

Americans are crazy. One guy with a blog has discovered a security flaw. There has been no exploit for this flaw. Nobody is complaining that they've lost anything. What's more, this "issue" can be fixed with a firmware update. But no! Our sense of entitlement tells us that this is another opportunity to take a bunch of money out of the pockets of an eeeeeeeeeevvil corporation ... and put it into the pockets of a bunch of lawyers. Awesome.

I love the part where Nokia hasn't even issued a response yet, and we interpret that as more reason to sue. Awesome.

Every other post on Slashdot seems to be decrying how messed-up the system is in this country, and then the next post comes along demanding that we shovel more coal into the fires. Get your heads straight, please.

Give me a break...

[Capt. Beyond]

Here's to sensationalism and mis-representation.

Nokoscope was not started by Nokia, but a one or two developers who happen to work for Nokia. It is not an official Nokia project, nor will it ever be, nor is it 'massive'. It will never be installed by default on any Nokia device.