Intercept email and see its content

Question

My new company has a monitor position. What a monitor does, is to monitor what anyone is doing. No IM, USB, phone with camera are allowed. I wonder within a WLAN, if a monitor can intercept my email, and see its content? Can he see my what I am browsing? Is it possible to use SSH to bypass all the data packages intercepting ?

Answer 1

Yes, all communications out of the LAN will go through the firewall and can be intercepted/monitored.

Encryption is one way to "hide" such communication, but it seems to me that if they're that paranoid about spying on you, then they'd simply block all encrypted connections anyway.

I would suggest that you do not try to circumvent their monitoring. If you don't like what they're doing, then you're free to find another job. While I certainly don't agree that limiting employee access to "personal" use of the internet is a good idea, companies are free to implement whatever policies they like and your circumvention of that policy could certainly be cause for dismissal.

Answer 2

If they have physical access to place a monitor node between the gateway and the switch or router that serves up your IP address, they have the ability to capture any data you send across the net.

For example: To monitor eMail data being sent across the pipe:

• create a port sniffer that captures packets for all the data being sent across SMTP (port 25) for outgoing messages and/or POP/IMAP for incoming messages.
• organize the emails based on their origin (IPAddress)
• x-ref the captured emails against a data base that maps IP addresses to employees within the company
• parse the actual email message out of the SMTP packets
• organize the messages in a system that makes it easy to search/read/crawl/etc the email messages

Web browsing is similar:

• use a port sniffer to capture data coming in on port 80 (HTTP)
• map the data-to-user relationship using a database of IPAddress-user data
• parse the data using a browser or a custom-built crawler or just store the address of the sites being visited by pulling the URI from the HTTP header

It's really not that hard to do, especially since all email and HTTP typically aren't encrypted.

There are ways around such a system. Such as using a VPN, or encrypting your data and encapsulating it in one of the protocols that aren't blocked on the firewall (ex. HTTP) but it would require a certain level of programming skill as well as knowledge of the networking domain. Plus, if you use something that doesn't get transmitted across one of the 'usual' networking ports (HTTP, SMTP, POP, IMAP) you might get red-flagged and/or blocked/investigated by the person doing the monitoring because of 'suspicious' activity.

Networking-security specialists usually know a lot of little tricks to find ways around a system. Unfortunately, a general systems programmer wouldn't know them because they usually take an intimate knowledge of the protocols and their vulnerabilities.

You can 'tunnel' encrypted data through a standard port using SSH but it requires that you have a dedicated SSH server running in a remote location. Just remember that, they can see everything you send across the net. If they consistently see gibberish (encrypted data) being sent across the pipe, you'll probably/eventually get red-flagged for it. Otherwise, they wouldn't go to all the effort to dedicate a person to monitoring the connections.

Answer 3

Thats a pretty big question, look at the capabilities of products like "IronPort" and see how anonymous you feel. :-) It's a really bad idea to try to subvert your employers security policy.

Answer 4

A new firewalls now also support SSL interception that means they can even see your HTTPS data now, however this is not legal in some countries, but yes almost all communications can be logged and monitored with firewalls.

Answer 5

First of all, being able to circumvent policy is not the same as allowed to do that, and different yet from a good idea: I'm pretty sure, with such policies, circumventing them would be punishable.

• e-mail: Certainly intercepted
• browsing: Almost certainly intercepted
• SSH and other workarounds: might work, but if USB devices and smartphones aren't allowed, I'd guess outbound communication will be limited (i.e. "it probably won't work"). Also, might not be allowed.

Even if you manage to get a tunnel up, passive traffic analysis will flag you: "This Tony guy has no outgoing connections, except these: long-lived, all to the same host, high-traffic, encrypted." Good luck persuading your employer ('s lawyers) you were not squirreling away the company's databases (having willingly and knowingly circumvented company policy isn't going to win you any points either).