Slashdot Mirror
'World's Most Secure' Email Service Is Easily Hackable (vice.com)
Nomx, a startup that offers an email client by the same name, bills itself as the maker of the "world's most secure email service." The startup goes on to suggest that "everything else is insecure." So it was only a matter of time before someone decided to spend some time on assessing how valid Nomx's claims are. Very misleading, it turns out. From a report on Motherboard: Nomx sells a $199 device that essentially helps you set up your own email server in an attempt to keep your emails away from mail exchange (or MX) -- hence the brand name -- servers, which the company claims to be inherently "vulnerable." Security researcher Scott Helme took apart the device and tried to figure out how it really works. According to his detailed blog post, what he found is that the box is actually just a Raspberry Pi with outdated software on it, and several bugs. So many, in fact, that Helme wrote Nomx's "code is riddled with bad examples of how to do things." The worst issue, Helme explained, is that the Nomx's web application had a vulnerability that allowed anyone to take full control of the device remotely just by tricking someone to visit a malicious website. "I could read emails, send emails, and delete emails. I could even create my own email address," Helme told Motherboard in an online chat. A report on BBC adds: Nomx said the threat posed by the attack detailed by Mr Helme was "non-existent for our users." Following weeks of correspondence with Mr Helme and the BBC Click Team, he said the firm no longer shipped versions that used the Raspberry Pi. Instead, he said, future devices would be built around different chips that would also be able to encrypt messages as they travelled. "The large cloud providers and email providers, like AOL, Yahoo, Gmail, Hotmail - they've already been proven that they are under attack millions of times daily," he said. "Why we invented Nomx was for the security of keeping your data off those large cloud providers. To date, no Nomx accounts have been compromised."
My hosts file protects me and my email from hackers. Thanks APK!
Anyone use proton mail? Is it as advertised?
Sorry but most secure email server is qmail. End of. That also can run on a pi.
Why UNIX?
Claims like that are just hacker bait. First point of security, don't broadcast the strength of your security.
"Imagination is more important than knowledge" - Einstein
https://www.nomx.com/ No nomx user was affected by this threat. No nomx user could be affected by this threat in the future. No nomx data was compromised, and the blogger has (finally) reluctantly verified this. He still has not publicly shared these statements, except via an email response to the BBC when directly asked on April 25 the response was: From the BBC to nomx: "I understand from your replies that you state categorically that no nomx accounts have been affected by this hack. I have put your questions to [blogger] who has confirmed to me that he cannot say that any have." While nomx is no longer based on Raspberry devices, we still maintain that the users' data is secured as we’ve demonstrated to the blogger, the media and our customers. For Media: We request that any media desiring to profile nomx security or this blogger to use this website with attribution to nomx (www.nomx.com) and to also include the statistics below. Due to large number of interested media, we are not able to respond to every reporter directly within the deadlines imposed and believe it is only fair to share with all media these same details. We invite all media who care to see on onsite demonstration of the nomx in action request and schedule a time in the Washington, DC or NYC areas in the coming weeks. We will provide a nomx and allow video, use of the nomx and any third parties to attempt to access the device. For Media - Some statistics: Number of nomx accounts that have been compromised since inception: 0 Number of Gmail accounts that have been compromised in the United States (from 2014): About 5 million to 24 million depending on source Number of other cloud-based emails compromised as of 2016 = 272 million Number of Yahoo accounts (including email) compromised 2013-2016: more than 1 billion The Future: nomx is now finalizing the “Cloud in Your Attic” server that also includes an internal nomx email server, and a host of other servers that maintain users’ personal data off the clouds that are regularly attacked daily. nomx ensures absolute privacy for personal and commercial email and messaging. Today's digitally connected world may feel modern, but the core of how we communicate online is based on 50-year-old code and protocols that expose every one of us to significant security risks whenever we send information across the internet. In the last two years alone, every major email service provider was hacked, exposing the private information of millions of people to cybercriminals. nomx ensures absolute security and privacy when communicating online by resolving issues with the Transmission, Routing, Acceptance, Communication header data, Encryption and Storage (TRACES) vulnerabilities that have been present in email since its creation.
Just add {In Space!} to anything.
Uh, this feels like something posted by a Nomx employee...
"Imagination is more important than knowledge" - Einstein
Just learn the basics of postfix or qmail on a FreeBSD server (you could use Debian or CentOS but, FreeBSD is supposedly best for security applications).
"Imagination is more important than knowledge" - Einstein
Holy wall of text, Batman!
The guy is doing his 'security research' with crappy tools on windows, so failllll
There is a new high tech method to security, make way for security through uselessness.
Come at me, hack my email, even if you read all my email it doesn't matter, it's all useless.
Hillary Swank has an email solution? Do tell! All along I thought she just had the long face.
I fell right asleep after he/she used brackets. Those brackets [ ] ..... zzzzzzzzzzzzzzzzzz
It appears the "hack" requires local hardware access to accomplish:
https://nomx.com/
The BBC provided the nomx devices for testing to a UK-based blogger who physically disassembled and rooted one of the nomx devices. Rooting was done, in his words, by disassembling the nomx case, physically removing memory card from the Raspberry and inserting it into his PC, and then resetting the root password. That is not an action a typical user would do, nor is it routine for a nomx device.
All these coders and "engineers" had the correct buzzword bingo to get past the women in HR...
FAIL, you LOSERS!!!!
You fail to realize why this response is, inadequate, fallacious, and utterly garbage. 1) Of course no nomx data was compromised, it was a test machine 2) How do they know that no nomx account has been compromised. They don't. They aren't a web service. This is a physical device, managed by individuals, not monitored by the company 3) Even if no one has been compromised, that doesn't negate the real, high risk vulnerabilities 4) Statistics don't tell a compelling story. Nomx is not used by billions of people, as such, the attack vector is statistically insignificant to warrant anyones time to attempt to hack it. Furthermore, I highly doubt they can hold up to the same standards as Google/Yahoo, or any other company they list on their website as being hacked in recent years. Typical apples to oranges. 5) 'In the last two years alone, every major email service provider was hacked' & `world's most secure email service` are unsubstatianted hasty generalizations. What's the criteria they're using exactly? 6) 'nomx ensures absolute security and privacy when communicating online by resolving issues with the Transmission, Routing, Acceptance, Communication header data, Encryption and Storage (TRACES) vulnerabilities that have been present in email since its creation.' How convenient. A snakeoil promise for problems that are extremely vague. Sounds like a strawman to me. Never even heard of the term T.R.A.C.E.S. And what exactly is it resolving with routing? Is this a router? Did they provide a new routing protocol? RIPv2 or OSPF isn't good enough for them? The BS meter is full.
nevermind this:
future devices would be built around different chips that would also be able to encrypt messages as they travelled.
So it's a fail right off the bat if it doesn't encrypt the mail in the first place.
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
"To date, no Nomx accounts have been compromised."
The I sense a great disturbance in The Force, as if millions of voices cried out, "Challenge Aceppted".
Ya kinda had me up until the part about the fax machines. Didn't the leaks show even faxes were being all caught up in the dragnet and recorded?
What exactly does that mean... encrypt as they travel? As someone that spent nearly a decade at a SaaS email security firm, SMTPS is only PtoP. If there are points in between, there's a chance that your email will have an unencrpyted hop. otherwise your looking at GPG/SMIME solutions... based on the info provided, I don't see what they are doing any different other than providing a "dedicated" box....
They are selling a mail server for who? It's not like you can run this device on a residential internet account, at least not here in the US. Running a server is against most major ISP's TOS and the majority block smtp ports, Since reverse DNS will not resolve correctly you will be blacklisted by every major email provider. So who exactly is this for?
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
See subject: & this is interesting (IMITATION = SINCEREST FORM OF FLATTERY) http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages// China's academy of science supercharge hosts file to save users plagued by DNS outages for a backup
APK
P.S.=> Enjoy being downmodded as a troll also fool... apk
Who would think that unscrupulous people would trick people... now excuse me while I help this Nigerian prince rescue his fortune.
Live today, because you never know what tomorrow brings
should I stay, or should I go
will it sink, or will it float
aim high, or aim low
we drive on the left, or we drive on the right
always prepared right, seatbelt fastened right
how long until the smell escapes, and where do you get the new filters
how long was I out for, and why does it hurt when I pee
metric or imperial vs imperial or metric
pikachu or team rocket
on or off
yes not no
no not yes
is yes or no equal two yesnos
sir what time is it, and do you have any grey poupon
some /. people were pointing out, I never ask any irelevant questions. while you could possibly be right about that, you know, the quality type questioning should make it evident I am equal at least to a shiny stupid new "interrogat0r 2030" but just think, I trained a Lot of pplz to eat their daily mems and probably save the lives of many many fake plastic test dummies brain cavity personally with only the one left bicep in pain, mostly, think shiny red fire engines and happy people with birds chirping. That's my wrath. Now either lead or get out of my way.
no that you see my quality production, you know you can feel like a GOD in comparison, so have a nice fork and shell each day, thank god your not a weenie
Isn't OpenPGP pretty much the best security one could reasonably hope for, for emails?
-Styopa
So take what you want from that.
You say things that offend me and I can deal with it. Can you?
"Everything else is insecure" is actually a pretty clever claim. It doesn't tell anything about their security.
From the summary: nomx is insecure. nomx is easily hacked. nomx is built on hyperbole.
Bluntly, it doesn't sound like nomx knows what the fuck they're doing.
There is also the fact that you can spend $75 + the cost of a hard disk and buy a single drive Synology or QNAP NAS which can run as a mail server, running sendmail/postfix, dovecot IMAP, and roundcube. To boot, it can back itself up to another NAS, an external HDD, Amazon S3, etc.
I rather just have my mail handled via O365 or an Exchange hosted provider. If I have something that sensitive, I arrange to use PGP or S/MIME with the other party... or perhaps use another medium for discussion.
1. Most ISPs don't allow residential customers to run an email service of their own.
Wrong. Sometimes, you may have to ask to have the port opened, but most allow it.
many domains will reject any email out-of-hand that's sent from just some random IP address
Set it up correctly. Set up the various SPF records and other such stuff. That'll greatly reduce the impact of this.
Furthermore, you *can* get your own static IPv4 IP that isn't in those blocks, and/or you can use a virtual server and forward that stuff, and/or you can use IPv6 to route around it, and/or you can use a different outbound SMTP server or forward through one. There are lots of ways around this trivial issue.
Why even bother with this when there's something like Proton Mail out there ...
Using a common service/server is one of the primary things this product is trying to avoid, as is using hardware/storage someone else owns (virtual servers / hosting / cloud / etc). There's nothing wrong with that part of the theory.
If you don't want to use a service like Proton Mail, what's wrong with using your own end-to-end encryption?
It relies on accessible and verifiable public keys and integration with the client software. That works within protonmail because all users get keys and can share public keys (AFAICT). Doing it yourself means pgp/gpg or s/mime, and both parties must have that, and there's no encryption of email headers (including TO, FROM, and SUBJECT) with those, so they won't be protected once they leave your server.
If you're really so worried about someone hacking into your communications over the Internet, then why are you even bothering with email in the first place?
What type of argument is that? Probably shouldn't use http either, nor facebook, nor any instant messenger, nor any search engine, nor the internet... heck, you should probably completely disconnect from every external line and seal yourself in a faraday cage within a bunker underground.
Email has loads of benefits and still the most widely used (head count) communication platform. It's certainly capable of sending an encrypted payload and the delivery mechanism is very well established... why not use it?
None of this means this product is good or worthwhile, but a secure communication appliance *could* be done right.
As far as I am aware, the only MTA that hasnt been hacked in a real-world situation is qmail, which is why it is still in use (and mostly unmodified - netqmail patches being the exception) since 1998.
See above: Hosts protect vs. malicious email payloads & interesting = http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages/ China's academy of science supercharge hosts file to save users plagued by DNS outages for a backup - yes folks IMITATION = SINCEREST FORM OF FLATTERY...
* "1.37 BILLION CHINESE CAN'T BE WRONG" - some fool took that from +1 down to 0 insightful & then 0 troll (gosh - I wonder who did that (not)).
(However the "1st hosts" stuff isn't necessary & I'm merelyt he broker of said protective information (that also speeds you up UNLIKE ANY OTHER "so-called 'solution'"))
APK
P.S.=> Especially Chinese via academia can't be wrong (per the old adage w/ an asterisk above)... apk