Email security hole at WebTV
Summary
In January 2000 a hole was discovered in WebTV, an internet service via television and set-top box, through which emails could be sent without the user’s knowledge. This was reported by the magazine Net4TV. At the end of 1998 the Microsoft subsidiary had already come under criticism for creating detailed user profiles without its customers’ knowledge.
Ideas
- Hidden code in newsgroup articles and web pages could control the box remotely.
- The box sent emails in the user’s name without them noticing.
- Such emails could contain orders, insults or illegal content in the victim’s name.
Insights
- Users rarely perceive devices that look like televisions as a security risk.
- A provider that secretly creates profiles also loses trust over technical errors.
Facts
- WebTV belonged to Microsoft.
- At the end of 1998 it became known that WebTV created customer profiles without the owners’ knowledge.
References
Critique
- The report relies on a single account and gives no statement from WebTV.
Remarks
- WebTV was later renamed MSN TV and shut down in 2013.
Recommendations
- Treat smart TVs and set-top boxes as a separate class of device on the network and isolate them.
- With networked entertainment devices, check what data they send to the manufacturer.
Links to the original source and the Web Archive open in a new tab.