Can emails be hijacked via a router?

July1962

I'm concerned because when I confided in a friend that my partner (who's very good with computers) seemed to 'guess' several details about friends (which he was never told about) and that he seemed to be very 'intuitive' about my plans, she suggested he may be spying on me.

After several checks for keyloggers etc came up blank, she suggested the router (hence my paranoia).

I may well be wrong (I hope I am) but if you ask someone directly "Are you spying on my emails?!" they're not very likely to admit it if you have no hard evidence.

I'm useless with the workings of a pc, and can't even see where/how I can access the router - let alone know how I can tell if he's been diverting my emails elsewhere as text documents.

fwor mentioned a routing table entry could show if this is happening, but I have no idea how I'd find this out.

I also know nothing about WPA/WEP or 'sniffing packets'!

JasX

Few red herrings above, first around wireless encryption on the router, yes this is a good thing and you should use it however it is possible to break even WPA, and if the 'suspect party' has control over the router and knows the WPA password anyway with a moderate effort and technical know how they would be able to decrypt your traffic.

What is worth bearing in mind is how you send the email will have a bearing, for example if you use outlook /outlook express/windows live mail on your computer to access your email via a pop3 type mail server they'll be very easy to intercept and read as plain text.

However if you're accessing your email via the web browser interface (eg going to the yahoo page and putting in your password there) depending on the provider you'll likely be in a secure SSL session so you're traffic is enncrypted between you and the email provider directly and it'd prove very difficult for someone sat in the middle on the router to decypher what you were doing.

If your PC is not up to date with microsoft security patches and/or your built in windows firewall has been turned off it would be very easy for someone on the network/connected to the same router on another machine to exploit a published vulnerability to gain 'back door' access to your PC and do a whole host of underhand things.

Worst of all for you is if the person has physical access to use the PC in question as they can then more than likely pick through your data at their leisure

July1962

Wow!
I do have outlook express but rarely use it.
I often use web browsers directly (yahoo / googlemail), as well as facebook/myspace.
My provider is Virgin (used to be NTL).

JasX

As an afterthought if you want to be very paranoid here's what you could do:

1-Do you have 100% physical control over the computer all the time? If not (and probably not if you live with the person and leave it at home when you're out) you should look into getting some software that encrypts the entire machine/hard drive. If you 'share' this machine with the suspect party stop doing so and/or get your own laptop for sensitive stuff.

2-make sure its secure from an outside attack on the same network -basically make sure the windows firewall is turned ON and that you are set to automatically receive security updated from microsoft

3-Only communicate sensitive information with the outside world via secure SSL browser sessions (look for https:// in the web address rather than just http:// and the padlock symbol, anything you type into a page like that should be safe from interception).

4-if you're worried something is already on the machine it could be very well hidden depending on how hard someone has tried -backup your data and reformat it back to the factory state.

Again, the above is for the particularly paranoid and should be quite resistant to someone very determined to spy on you, it goes beyond 'basic' security that most people would be perfectly ok with.

JasX

PS as an afterthought on another line of attack make sure you use strong passwords and security questions on your email and facebook accounts, if he's guessed your password it doesn't matter how secure your PC is as he can log into your account from anywhere in the world if he has the login info

nowtsquared

Change all your passwords to hard to guess ones, all different, Keep the list of p/w safe from prying eyes.
I would also ensure that anything with a camera is kept secure.

totalsolutions

Also if your PC hard drive is "shared" anyone can read the contents of the harddrive from home network, any Administrator can read/see any PC under his control..

Ximian

JasX wrote: »

However if you're accessing your email via the web browser interface (eg going to the yahoo page and putting in your password there) depending on the provider you'll likely be in a secure SSL session so you're traffic is enncrypted between you and the email provider directly and it'd prove very difficult for someone sat in the middle on the router to decypher what you were doing.

Most free email providers such as Yahoo Mail do have encryption, but that's just for the initial login. After you've logged in, the session is plain HTTP and messages can still be intercepted and read in plain text.
There are email providers out there that claim to provide secure email, such as Hush Mail and S-Mail, both use PGP.

July1962

Lots of VERY useful tips and advice from you guys - for which I am VERY grateful
PC is not shared physically but is on a home network.
Passwords are changed regularly to bizarre combinations (!) that only I could understand, however, I'm not quite sure if these passwords are being hijacked.
Security questions would be impossible for anyone else to simply guess.
Firewall is on / updates set etc...
I do turn the pc off when I leave the room for any length of time.

It's good for me to understand how I can try to keep my emails private, however, I can't be sure if I'm simply over reacting to his 'amazing intuition' or whether he IS reading this stuff in my messages to friends.

Thanks again for all the ideas.... MUCH appreciated

weegie.geek

The fact that you suspect your other half of doing these things makes me a little uncomfortable. You shouldn't have to sneak around, being paranoid that he's snooping.