Nokia Admits to Decrypting Secure User Data But Denies Spying on Customers
Nokia can ill-afford any missteps as it attempts to rebuild its brand into a major smartphone player, so it's a little concerning on a number of levels that it was caught intercepting Internet traffic on its phones and redirecting the data through its own server farm. Is Nokia engaging in so-called man-in-the-middle attacks against its own customers?
That's the conclusion Gaurang Pandya came to, who first discovered that HTTPS traffic was being diverted through Nokia's servers. Pandya, who is an infrastructure security architect at Unisys Global Services India, says "it is evident Nokia is performing man-in-the-middle attacks for sensitive HTTPS traffic" originating from his Nokia Asha phone. What's alarming here is that the way Nokia is going about it, the company has "access to clear text information" such as bank logins, credit card information, and other sensitive data.
When pressed by TechWeekEurope, Nokia didn't deny that it was intercepting web traffic, but refuted the notion that there's any malicious intent behind what it's doing. It's just the way Nokia's traffic compression feature works, which results in faster page loads.
"The compression that occurs within the Nokia Xpress Browser means that users can get faster web browsing and more value out of their data plans," Nokia told TechWeekEurope. "Importantly, the proxy servers do not store the content of web pages visited by our users or any information they enter into them. When temporary decryption of HTTPS connections is required on our proxy servers, to transform and deliver users' content, it is done in a secure manner."
Nokia further added that it has technical safeguards in place to prevent access to private information.
That's the conclusion Gaurang Pandya came to, who first discovered that HTTPS traffic was being diverted through Nokia's servers. Pandya, who is an infrastructure security architect at Unisys Global Services India, says "it is evident Nokia is performing man-in-the-middle attacks for sensitive HTTPS traffic" originating from his Nokia Asha phone. What's alarming here is that the way Nokia is going about it, the company has "access to clear text information" such as bank logins, credit card information, and other sensitive data.
When pressed by TechWeekEurope, Nokia didn't deny that it was intercepting web traffic, but refuted the notion that there's any malicious intent behind what it's doing. It's just the way Nokia's traffic compression feature works, which results in faster page loads.
"The compression that occurs within the Nokia Xpress Browser means that users can get faster web browsing and more value out of their data plans," Nokia told TechWeekEurope. "Importantly, the proxy servers do not store the content of web pages visited by our users or any information they enter into them. When temporary decryption of HTTPS connections is required on our proxy servers, to transform and deliver users' content, it is done in a secure manner."
Nokia further added that it has technical safeguards in place to prevent access to private information.
