2

The company I work for is involved in security clearance work, and thus all company computers are monitored (files, screenshots, etc).

I am routinely logged onto my company email service with my personal laptop. I have some questions regarding the use of sophisticated company email services when on a remote personal computer.

  1. When I am logged onto the company email service, is it possible for this company email service to upload files from my computer? Can a company email service gain access to my files in any way?

  2. When I am logged onto the email service, can the company email service monitor my personal computer (recordings, screenshots, etc)?

Anders
  • 64,406
  • 24
  • 178
  • 215
Vegan
  • 21
  • 1
  • Not really enough information to say definitively, but yeah, probably. If a cybercriminal can leverage a malicious advertisement to download and run malware on an unsuspecting user's computer, why would you assume that a security company couldn't do the same (or similar)? Of course, there's big difference between something being technically possible, and it actually being done to you. – HopelessN00b Jun 16 '16 at 22:33
  • 1
    Is this e-mail service accessed through a web site or program installed on your computer? That will matter a lot. – Ben N Jun 16 '16 at 22:58

1 Answers1

3

Depends what you mean by "email service", since as a general rule you're using some client to access an email service, and clients have different capabilities and restrictions.

For example, mobile clients (smartphones) usually provide some support for Mobile Device Management (MDM). While MDM doesn't often involve retrieving files from the device - it's more focused on things like "ensure your device has a strong PIN" and "allow the company to remotely wipe your device if it gets stolen" - in theory it's possible. Some MDM solutions allow the company to install arbitrary apps to your phone, and those apps could potentially access your files and send them back to the company. Mobile email clients vary in how much MDM they support, with the built-in apps usually having the most (though exactly how much that is depends on which mobile OS you're using) and third-party apps (from the store) usually having much less, if any.

Desktop PC clients (Outlook, Thunderbird, Mail.app, etc.) tend to be much more under your own control. Some offer a little bit of device managmeent, but I'm not aware of anything that would let the company read arbitrary files. The company may require you to install and run some other program (like a VPN client) before you can access the email server, and that other program could do things like you describe, but the email client itself probably cannot. At least, it won't do such things just because you connect to the mail server. One could certainly write a (for example) Outlook add-in that contains some sort of corporate spyware, but they can't automatically install that add-in on your computer; you'd need to do that yourself.

Webmail clients (Gmail, Outlook Web Access/App, etc.) are actually the most restricted. Webmail is, of course, accessed through a web browser, and web browsers have very tight restrictions on what a web site can do (among other things, these restrictions prevent accessing files on your computer unless you manually upload the file to the web app). Furthermore, most browsers (Firefox being the notable exception) have sandboxes so that even if a web site compromises the browser, they still can't access most of your computer. Of course, there's still the add-in/extension attack vector - if your company requires you to install a browser plugin before you can access their email, that plugin could do anything including read files - and also the potential VPN client issue.

So, technically speaking, no. An email service should not be able to monitor your files or computer usage. In the case of a mobile device, maybe it would be possible, but with a desktop PC or especially with webmail, nope. Not without completely compromising the security on your email client and taking it over.

That brings me to the second point, which is that employing spyware like that on privately-owned computers without the user's knowledge and consent would be illegal in most jurisdictions (even if they didn't need to compromise software on your computer - which is itself illegal - to make the spyware run). Now, spyware is not illegal per se; if you install a VPN client and it tells you it's going to monitor your computer usage and you click OK anyhow, then you've consented to having your computer monitored by that software. If it doesn't tell you that but does it anyhow, though, you'd probably have a solid case for a lawsuit (I am not a lawyer, this is not legal advice, please review your own employment contract and/or legal code, and hire a lawyer if you need legal advice).

CBHacking
  • 40,303
  • 3
  • 74
  • 98