12 ms·
MS Exchange “remote wipe” is a terrible, terrible bug
- napierzaza 16y agoI work in IT and my boss is precisely like this. We don't manage mobiles but wireless. He's talked about scanning the multi-campus network to find unauthorized microwaves that he can have removed. Because of course, it might cause _some_ interference for 30 seconds at a time right? Yeah.
- dedward 16y agoIf you are in the US, it's likely illegal for your boss to try to regulate microwave ovens based on causing wifi interference - that's solely the job of the FCC. The regulations that allow the use of 2.4Ghz ISM band require you to accept that interference....
- jonknee 16y ago... Not if the microwaves are in your control. You can certainly police microwaves on your own campus. (Not that this is an intelligent idea.)
- tomjen3 16y agoBug? No this was done intentionally. Does anybody know how you disable that "feature"? Preferably in such a way that it causes maximum harm to the organization that uses it.
- dablya 16y agoDon't connect personal devices to corporate exchange?
- Stimpy 16y agoBingo.
- mseebach 16y agoYeah, and girls who walk home alone at night had it coming if they're raped. Of course, we know it's a bad idea to mix work-devices and private devices, and we probably also have little trouble procuring a work-smartphone if we need that. But for a non-IT person with his new iPhone, exited that pointing the Exchange app to mail.work.com just works, it's unacceptable.
- tomjen3 16y agoLook I have a degree in Computer Science, I wrote software to send the strings necessary to use IPOP, heck I even memorized the RFC number (1939). And in all this time, never did I once see anything on that protocol that could do anything more than download mail and delete the mail you had in your account. So I hear about Exchange and figure "oh just another protocol MS came up with, properly has extensions for calendars and stuff". Now if I don't know this is going on, how can anybody know? It would be one thing if the device said "by connecting to this system, you allow it to removely wipe this device allow/deny?" but it doesn't. And that is criminal.
- megablast 16y agoNo, it is not criminal, it is an essential component of ensuring security in lost devices. It would be completely useless if it asked if it was ok to wipe the device. If you are unable to understand that Microsoft added a lot of stuff to the exchange protocol, and this is one of them, perhaps you are in the wrong field. This is not top secret information, it has been around since Windows CE, and is requested by all big businesses.
- StavrosK 16y agoIn defense of this feature, it's very important for when a phone is lost. However, I agree, deleting peoples' data for reasons other than the device was compromised is just a sadistic thing to do.
- ams6110 16y agoWell, if people are using un-approved personal devices on the corporate network, it seems there is some fault on both sides. Assuming there is policy addressing this issue.
- xpaulbettsx 16y agoSure, but you send out an Email warning people first. There's no reason to wipe people's devices unless they are willfully defying policy, and even then, you've got a list of the people doing it - just go to their office and talk to them in person (involve their manager if needed). Wiping a personal device to "send a message" is passive-aggressive and totally destructive to morale.
- dedward 16y agoIt's also quite likely completely illegal - warning or not. It's a personal device - the company has no rights to it.
- jodrellblank 16y agoThen it has no business being borged into the corporate IT system of a company which demands rigorous enough control of data to use remote device wipe.
- jarek 16y agoYou handed the company rights to it when you added it to the Exchange domain. The only issue at hand is whether a phone should be more explicit in telling you doing this will hand IT complete control of the device.
- 16y ago
- xpaulbettsx 16y agoIf an IT department did this to me without warning, I'd quit that day, CC'ing my manager and the IT guy's manager telling them exactly why they'll now have to spend months finding and training my replacement.
- pavel_lishin 16y agoI'd probably also send them a bill for the cost to me, in time and effort, or restoring all my data.
- fname 16y agoThe simple answer is not to store company email on your phone. Then you shouldn't have to worry about this.
- jodrellblank 16y agoI parked my personal car in the company fleet car garage and they clamped it. I didn't understand what was happening and called the rescue company telling them it had broken down and wasted lots of time. This was so unfair I quit that day, causing a dramatic fuss pointing out exactly how much they'll suffer. That'll show them.
- Splines 16y agoYour analogy would be more apt if you once parked your car in the company lot, and then years later some IT guy sneaks into your house at night and clamps your car.
- achille 16y agoImagine today one of your employees quits on the spot, tells you he's quitting because his car was clamped. You have no idea who manages the parking lot, but now you just lost a resource on your project. How did your manager end up reacting?
- jodrellblank 16y ago
- eitally 16y agoThe problem is that right now there aren't granular enough controls of remote devices to allow people to adequately differentiate between approved ones and illicit ones. The fault lies on both the side of the client device software and the server side software. The same goes for Gmail (Google Apps Premium Edition only) and Android (or anything else using Google Sync). You can enable/disable IMAP & POP for the domain and if you enable it you open the floodgates. You can selectively enable/disable users via API but they can toggle it back on their own. If you setup Google Sync instead of IMAP/POP you can remotely wipe devices but you can't do anything except wipe everything and there is no inbuilt method to notify the user first. Exchange, as described in the blog post, is equally bad. I'm confident things will improve in 2011 but it's unpleasant right now. The best thing companies can do is to set a clear policy on what's allowed and what isn't based on their data security needs, and never violate the users' trust.
- lovskogen 16y agoSo even using a GMail account on my iPhone will allow someone (Google) to remote wipe?
- Niten 16y agoThis is one of the reasons I use a third-party app (NitroDesk TouchDown) for reading Exchange mail on my Android phone. If someone hits "remote wipe" it'll only delete your Exchange data, the rest of your phone remains untouched. http://groups.google.com/group/nitrodesk/browse_thread/thread/231fc50e6337afe7 http://groups.google.com/group/nitrodesk/browse_thread/threa... The app doesn't have permission to wipe the entire phone even if it wanted to.
- pclark 16y agoCan you store email/attachments/other information outside of the application? If so that application is a massive security risk.
- furyg3 16y agoThis is crazy talk. If it's a major security risk, don't sync it to someone's pocket. By syncing it to someone's pocket... it's out. Especially if it's on their personal phone, you can't control what they (or an attacker) will do. Either that's an acceptable convenience / risk tradeoff, or it's not. If it's not, you need to focus your efforts on tagging confidential data and keeping it inside the "walls" of your organization... but that's not a technology problem, it's a people problem.
- pclark 16y agosyncing to someones pocket is fine if you can remote wipe it
- furyg3 16y agoBut you can't guarantee that you can wipe it. What if it's not connected to the 3G network? What if the data has already been pulled off? What if it's been copied to a memory card on the phone? What if the phone doesn't properly implement this feature?
- 16y ago
- avar 16y agoSo to connect to an Exchange server in iOS, Android or WebOS you have to give the server root on your phone? What sort of crazy security policy is that?
- deleted 16y ago[deleted]
- whatusername 16y agoSo you connect and store a bunch of confidential and important information on a device that you can leave at a bar?! What sort of security policy is that?
- mike-cardwell 16y agoJust use IMAP instead. There's no remote wipe protocol in IMAP.
- CallumJ 16y agoThat's if the Exchange server hasn't been configured to ONLY allow ActiveSync connections.
- kogir 16y agoActually, this has existed since exchange integration was first added to PocketPC (a long time ago). It allows companies to control the security of their data. Joining your personal phone to exchange is much like joining your personal computer to the corporate domain. You don't do it unless you want corporate IT to administer it and corporate policy allows it. Edit: I sympathize with people who lost data, and do agree that the phone should warn you before completing the join. That said, as a business owner, I only allow exchange (and not POP or IMAP) for exactly this reason. I need to be able to wipe the company data if a phone is lost, or someone is fired (and not cooperative), etc. The real world isn't always nice. Also, the full device wipe is by design, and the feature is called "Remote Device Wipe." The details can be found here: http://technet.microsoft.com/en-us/library/bb124591.aspx http://technet.microsoft.com/en-us/library/bb124591.aspx Note that the storage card is also wiped (where attachments and other sensitive data may be saved).
- cubicle67 16y agoWiping your company's email, sure. But you don't seem to have a problem with wiping the entire contents of someone's personal device and (if I read the article correctly) rendering that device unusable thereafter (after a restore it remote wipes again) Would you be happy with just an email wipe, if that option were available?
- kogir 16y agoAfter the remote device wipe completes the device is usable again unless they try to link to exchange again. In the cases I talked about they shouldn't be joining again. In most cases there is more than just email, and the line between exchange and personal blurs. How do you remove the exchange data from a contact originating from exchange but updated with Facebook data? What about company restricted WiFi passwords? Attachments saved outside of the mail program? It's complicated, and when properly used: a last resort. Edit since I can't reply below: Linking with activesync is optional. The policies are part of the bargain. Your examples either weren't optional (RIAA) or were things you'd choose not to do (EA).
- 16y ago
- jey 16y agoIs the "remote wipe" command really supposed to delete all the data on the device? It sounds to me like it's meant to erase just the data associated with the Exchange account, but that the implementors misinterpreted it to mean "erase the whole volume".
- deleted 16y ago[deleted]
- jackvalentine 16y agoYes, because once things hit your exchange account they can leak all over the phone. Attachments stored on it's flash storage/SD card and the like.
- 16s 16y agoHe's blames the remote wipes on the local IT guys. Calls them sadists. But I bet they are just doing what their corporate policies require them to do. The policies are written by the suits in management, not the local IT guys. If you want to bitch, bitch at them.
- tomjen3 16y agoWhy not just bitch at them both? And then call the police on the IT guys, since they just hacked your device. Doing your job isn't an excuse.
- megablast 16y agoAs far as they new, someone was hacking their servers, downloading unauthorized emails. This is completely what you would expect them to do. The fact you can't see this, and change your world view to understand what is really going on, suggests that you are very young and being unreasonable.
- rbanffy 16y ago> This is completely what you would expect them to do. And, sure, they expect evildoers to be using software that honors a remote-wipe command. Yeah, right.
- patio11 16y agoDo folks here not work in a regulated industry? We went through a yearly course on How To Not End Up On Front Page of The Paper For Leaking Customer Information. One core part of that is putting up with a little hassle with regards to managing one's cell phone, such as a) not using it for work if at all possible and b) very carefully regulating what got saved on it if it was used for work. (Nobody at my office should have more than "P. McKenzie" and my phone number saved on their phone. Including full name, email address, a photo, my address, and the like would give me a cause of action against the company if the phone was ever lost or if that information were misused.) A smart device capable of downloading an email attachment could cause a multi-million dollar incident if it was lost. All it would take is a bug tracking system report with an attached file showing e.g. the wrong number of lines printed per page of radioactively sensitive customer data.
- wwortiz 16y ago> (Nobody at my office should have more than "P. McKenzie" and my phone number saved on their phone. Including full name, email address, a photo, my address, and the like would give me a cause of action against the company if the phone was ever lost or if that information were misused.) That really can give you cause of action against a company? In a similar matter what if I had all of that information on my personal phone, am I correct in assuming that it shouldn't give you the right to sue if that information were released. (As it assumes you either gave me that information, or it was obtained through you in some way) And in the case of the email attachment, if you are sending radioactively sensitive customer data in any way through email isn't that the real problem and not that the phone could get out.
- tptacek 16y agoNo, that's not the real problem. The transmission of sensitive information through corporate email is commonplace. Formally-classified protected information like HIPAA PI or payment card data shouldn't, of course, be emailed, but information that can be traced back to PI is sent routinely. Regardless of whether it should or shouldn't happen, IT controls people have to assume it will. The contract for syncing with a corporate Exchange server, in many places, simply requires you to allow your phone to be wiped. If you don't like it, don't sync with your company's Exchange server. What's so hard about that?
- kuahyeow 16y agoAt first read it seems like a normal, in fact, useful feature, but the key line is this: "When he turns it back on, it’s back to factory defaults. All the settings, apps, and data have been erased. wtf?" Major case of Exchange over-reaching and wiping more than just Exchange data !?
- jackvalentine 16y agoAs has been said elsewhere in the comments, it overreaches because once that data hits your phone it can leak in to other applications, the phone can store attachments on it's flash storage or the SD card, etc.
- pclark 16y agoUhm. Data loss is a huge deal. HUGE. This isn't an evil feature. It isn't a pointless feature. In fact it's a critical feature in the running of an organisation. Email. Calendar. Address Book. A gold mine of absurdly sensitive data. If you want corporate email on your phone, expect to have the possibility of a remote wipe. It isnt Microsofts fault that people use it maliciously. If you ask the user "do you wish to allow administrators to remote wipe your phone allow/deny?" what do you think they'll click ??? People don't care about data loss. Educate someone on how to not lose data, then a week later give them a laptop with a password protected screen saver/login - first thing they'll try to do is remove password. The amount of company phones I see with no passcode lock is astounding - I can pick your phone up, forward emails to myself and have all your information. Bang. Don't think data loss is a big deal? If you google "PA Consulting" a top link is how they lost a USB drive.
- blahedo 16y ago> If you ask the user "do you wish to allow administrators to remote wipe your phone allow/deny?" what do you think they'll click ??? They will probably click "deny", and then not be allowed to connect to the server. Problem solved!
- caf 16y agoExactly. It astounds me how many people are managing to miss this point!
- jodrellblank 16y ago"Solved" unless they don't read it or don't remember it. All you've solved is the ability for IT to say "told you so". You haven't solved the careless didn't-read-it end user from losing their data and thinking their phone is faulty.
- pclark 16y agoThat solves nothing. You'd then have to buy company blackberries (probably for the best) as no one would be able to use corporate email on their home phones.
- extension 16y agoCan someone confirm that the remote wipe actually works as described on each mobile OS? And that it can be done through a Google domain just by using their sync feature with a company account?
- pilif 16y agojust had some fun with the phone of a coworker of mine (of course after warning him and making sure that he won't lose data). His iPhone was connected to our Google Apps account and with one click I managed to wipe his phone (it rebooted and came up with the "connect me to iTunes to activate me" screen).
- jodrellblank 16y agoThis is remote wipe as used by Microsoft Activesync and mobile OS's which support Activesync (Windows Mobile, iOS and Nokia with third party extensions). What do Google domains have to do with it?
- rdouble 16y agoGoogle for Domains uses Activesync to do push email.
- jodrellblank 16y agoAhh.
- ja27 16y agoNot sure about other Android versions, but my 2.2 warned me about this when I set up my Exchange account. It also warns me about this every time it first connects to Exchange after a reboot. Not much I can do about it. I more or less trust my IT guys not to be dicks so I don't lose any sleep over it. But short of carrying two phones, there's no way for me to separate personal and work devices. I do keep a nandroid backup on my personal netbook though.
- theBobMcCormick 16y agoVanilla 2.2 on a Nexus One here, no such warning. :-(
- Poiesis 16y agoI had no idea there were so many people unfamiliar with secure networks. Anyone who is anywhere near U.S. govt classified networks knows that if they hook up their device up to one of them, they will be lucky to get their equipment sans storage media--and quite likely delivered with a pink slip. Corporations may not have national security in mind when they protect their data but to them their data is every bit as important. What I want to know is, can Google wipe my iPhone if I have Exchange synching? Looks like that's a "yes". How about an option to wipe my device, myself? Wouldn't mind getting that without paying for Mobile Me.
- omh 16y agoI believe that Google Apps now supports remote wipe (http://www.google.com/support/a/bin/answer.py?hl=en&answer=173390 http://www.google.com/support/a/bin/answer.py?hl=en&answ...), but you need to pay for a premier account. A better deal than Mobile Me, if that's all that you want.
- JohnnyBrown 16y agoSo, is there a way to safeguard against this? I assume when I connect to an exchange server at home it doesn't have root access to my laptop, right?
- raganwald 16y agoAmazed your question doesn't have upmods, it's very original. Can my personal laptop be remotely wiped if I connect my email client to an exchange server? If not, why not? It seems to me that a laptop is even more likely to leak sensitive information out of email, like spread sheets and word documents.
- T_S_ 16y agoSeems like we need something like vmware on phones. Then I can run the company's phone on my device. They can wipe, er, administer it any way they must. And I can still have one phone.
- dtsingletary 16y agoOne point not being made here is that nearly every wireless carrier requires you to add an Enterprise Data Plan to your service in order to use an Exchange connector. AT&T requires this with the iPhone. Verizon, T-Mobile, etc. all require it for the Blackberry. I haven't heard of a single device/provider that doesn't require an elevated service level to allow for enterprise mail access. So there's a security by obscurity to start with: the average user doesn't know to ask for the Enterprise plan, let alone what Enterprise even means in context. So the scenario here requires that a) the salesman talked them into it, b) they bought into that service for the extra $15 on top of the data plan, or c) they consulted with the company's IT department or policies and knew they had to get that service. If they didn't, they simply cannot connect to the Exchange account. There's very little "oops, I didn't know what I was doing" here. I hope that most companies have a clear policy against checking your work e-mail from personal devices, and on your own time. There are legal implications for overtime pay. We may look the other way in startups, but this can't always be done. Most law firms require this, unilaterally. It's part of the deal-- we'll pay your enterprise data plan in exchange for knowing that we may wipe the device, control which apps you can install [this is another can of worms], so on and so forth, per the requirements of malpractice insurance and data security. In a perfect world this wouldn't be required, but I think we all know this can't possibly be the case in many industries.
- Lazlo_Nibble 16y agoUgh--sorry for the inadvertent downvote. My bad.
- v21 16y agoI upvoted to cancel you out.
- dtsingletary 16y agoI get the point the guy was making, but it seemed a little dickish. Thanks.
- yason 16y agoWhat is the offending module or piece of software on, for example, Android that does this? If it's an Exchange specific thing and works on many phones, why does it come preinstalled with root access and can I just disable or enable Exchange support to be sure nobody ever nukes my phone?
- arethuza 16y agoMaybe it's because I've had a reasonable amount of exposure to the security measures taken by large companies (and the associated unpleasant legal measures that can be taken) but I follow these rules: - No corporate data on personal devices (not even email) - I expect to be given a work smartphone - I use my own phone and iPad for personal stuff - Assume that anything you do through a device attached in any way (even a VPN) to a corporate network may have everything you do monitored Of course, these rules apply mostly when you are working for a large company, but even when you are in a startup you occasionally may have to work at a client site - and often these are large corporates.
- kabdib 16y agoI once lost my phone, with work email on it. I used the remote wipe as soon as I knew the phone wasn't coming back. Someone had gone to the trouble of keeping the phone charged; it got the wipe a good 24 hours after the battery should have died. I was very, very happy the facility was there.
- funkdobiest 16y agoSo our company will not let iPhones connect to the Exchange servers from outside the corp firewall. Solution: Set up a separate mailbox on an external web host and use an exchange rule through Outlook to redirect emails to that address, all the while filtering for things like confidential or classified documents, and check the mail from my phone.
- runjake 16y agoThis is a feature, not a bug. If you don't want your personal device to fall under your organization's security policy, don't connect it to your organization's Exchange (or any other) servers. It's saved our bacon in regards to stolen devices a few times.
- raganwald 16y agoI'm confused by all the arguments that this feature should exist. Of course it should exist. Re-read the OP: The bug isn't the remote wipe ability, the bug is leaving it up to the administrators of the server to decide whether to inform users that the feature exists. Google decided to do an end run around Apple's lack of support for push notifications by making Gmail an Exchange server. Until now, I had no idea that by going along with this I was granting Google remote wipe privileges on my phone. Sure, Google do not appear at this time to want to wipe my phone for any reason, but how is it that I've been unknowingly trusting them with this power? This privilege is decidedly non-obvious. When I connect to an email server I kind of expect that I'm giving someone, somewhere the ability to read my mail. That's "obvious," and I don't need a warning dialog. But what is obvious about granting Google the right to erase the pictures I've taken of my father-son Lego Jawa Sand Crawler project? Or my voice memos? Or the extensive notes I've been making of design ideas for my Javascript framework? Let's stay on topic, folks. The question to be debated isn't whether companies should have remote wipe privileges, it's whether a device should allow a user to grant such privileges without putting up a simple warning dialog.
- lurkinggrue 16y agoThis person seems to have issues.
- omh 16y agoI'm a sysadmin at a place that wants this sort of protection, and historically we've only used Blackberries. Now that lots of people have iPhones, I'm explaining the "remote wipe" situation pretty often. The best compromise I have at the moment is an iPhone optimised web interface. This lets you get your emails on the device without (much) danger of them ending up saved there.