Feeds

Nokia decrypts browser traffic, assures public not to worry

It’s acceleration, not snooping, say Finns

Top 5 reasons to deploy VMware with Tegile

Just as Nokia announces numbers that look like it may avoid irrelevance, the mobile supplier has become embroiled in a privacy row centered on the behavior of its browsers.

The brouhaha hit the wires when Unisys Global Services India security architect Gaurang Pandya wrote up his investigations into the behavior of his Nokia Asha phone.

Discovering that browser traffic was being diverted to proxy servers owned by Nokia – a common behavior in the mobile world designed to improve browser performance on skinny mobile data links – Pandya began investigating what else was happening to his traffic.

The results are documented here. In brief, Pandya accuses the vendor of staging a man-in-the-middle attack against its own users: even for HTTPS traffic (his test case was https://www.google.com), he writes, the phone sends a DNS request to the Nokia-owned cloud13.browser.ovi.com domain.

This raised the question of how the ovi.com server was handling certificates. By packet-sniffing the traffic, Pandya identified Nokia certificates that the phone was pre-configured to trust – with the result that the substitution of the ovi.com server for Google didn’t throw out a security warning.

His conclusion is that this behavior gives Nokia full, unencrypted access to browser traffic.

According to TechWeek Europe, Nokia has agreed that the diversion takes place, to allow it to compress Xpress mobile browser traffic for acceleration. The company denies storing the data, and says that none of the traffic is visible to any of its staff.

“Importantly, the proxy servers do not store the content of web pages visited by our users or any information they enter into them. When temporary decryption of HTTPS connections is required on our proxy servers, to transform and deliver users’ content, it is done in a secure manner,” the vendor told TechWeek Europe.

The row comes as Nokia announced what looks like a turnaround, releasing financials showing a profit on smartphone sales, compared to an October forecast for a 10 percent loss. It announced fourth-quarter sales of 4.4 Lumia units and 9.3 of the low-end Asha smartphones. ®

Security for virtualized datacentres

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Will BlackBerry make a comeback with its SQUARE smartphones?
Plus PC PIMs from company formerly known as RIM
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
EE buys 58 Phones 4u stores for £2.5m after picking over carcass
Operator says it will safeguard 359 jobs, plans lick of paint
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Google+ GOING, GOING ... ? Newbie Gmailers no longer forced into mandatory ID slurp
Mountain View distances itself from lame 'network thingy'
Vodafone to buy 140 Phones 4u stores from stricken retailer
887 jobs 'preserved' in the process, says administrator PwC
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.