29/04/2017 Click - Short Edition

Over the last few years, billions of e-mail accounts

Last year, Yahoo announced that over 1.5 billion e-mail accounts

were compromised between 2013 and 2014, the largest

Then it emerged that Russian hackers had gained access to 60,000 e-mails

from Hillary Clinton's presidential campaign.

Some believe the resulting leaks helped swing the election for Trump.

is something most of us already knew.

We send, each of us, all the time, hugely personal information

Information that we'd like to keep private,

but others are all too often able to see.

So how about something that guarantees to protect

Sounds like something you wanna have, doesn't it?

Well, this is Nomx, a box which promises

It was at CES that we came across this device as it was introduced

I met the boss, Will Donaldson, who has impressive security

He's worked in computer security and built web applications

for the Pentagon, the Marine Corps and he was Chief Technology Officer

for the F35 joint strike fighter communications facility.

So what does he think is wrong with bog standard e-mail?

Well, the Nomx promotional videos explain the problem.

When you send an e-mail, copies of the message end up

on several internet servers along the way.

Will says all of the recent big e-mail hacks have involved one

of these servers being compromised and what's more

So those vulnerabilities, we've identified six core ones

that encompass 100% of hacks that have occurred to date.

Will's solution is a $199 box that acts as your own

It'll talk to other e-mail services, but where it comes

into its own is when it connects directly to another Nomx box

at the other end, the pair of them replacing the cloud servers

that your message would usually flow through.

That means no copies are stored anywhere

The idea has caught the imagination of some in the security industry,

who've called it a "personal cloud on steroids" and Will himself has

become a bit of a star, being interviewed on US national

television and elsewhere in the media as a security guru.

So what you're pitching here is that you can make a black

box, that black box there, that is more secure

than a multibillion dollar company's servers?

It's been proved they're vulnerable, my question is to you is,

you're not a multibillion dollar company.

Not yet. Not yet.

Why should I believe that your security is any better

than theirs and why should I believe that there are no vulnerabilities

that you have accidentally left in your box?

What we've done is identify the categories of those

vulnerabilities and all of the hacks have occurred have been

By removing them from the equation, we've now negated them

So the theory sounds a good one, avoid making multiple copies

of your messages across potentially vulnerable servers on the internet.

You just have to rely on the Nomx boxes themselves not

You all know this man, Dan Simmons, one of Click's most experienced

reporters and famously, if someone says something

is unbreakable, you try and break it?

Well look, often on this programme we look at new things

as anybody else to see them, but sometimes just sometimes,

something seems a little bit too good to be true and absolute

security, I've never heard anyone in the cyber security industry

promise that, but that's exactly what this company are doing.

So to prove a point, you're going to try and hack this box?

I think I've found somebody who may be able

Scott Helm is one of the UK's most respected professional white hat

He's helped discover some big security flaws in the past,

including hacking home routers and electric cars.

Scott's had the Nomx box in his hands for just a few minutes

Hey, Scott. How's it going?

How'd you get on? Good, yeah.

I've had a look over this device and I was quite surprised

So when I flipped it over, we saw what we call the Mac address

here, which is the device's unique identifier and these first three

segments identify the manufacturer, that tells you who builds

So I went away and I looked these up and they're actually registered

to the Raspberry Pi Foundation that make the Raspberry Pi computer.

That's the hobbyists' computer we've seen on Click.

But Nomx is the manufacturer, right? Yeah.

So what I did, I went ahead and opened this up

Is there is in fact a Raspberry Pi inside this, which is white

There's nothing else they've done with this that we can see inside.

That is just a standard ?35 Raspberry Pi.

But what does that say to you when as a security guy

I guess, there are further things to be found here that

I've also asked Professor Alan Woodward, a well-known cyber

security expert, who's advised the UK Government and Europol

to take a look at the Nomx box to see how it works.

Well, already through the set-up process, there's a few things

for a product that bills itself as being absolutely secure,

there's a few things that we found that give rise for concern.

And we certainly want to look a bit further into it.

Just plugging it in has sent alarm bells ringing for Alan.

The set up of the device is through a web application that

It doesn't ask Alan to open up port 25.

Now, that's a key port on his router he will need

to communicate with popular e-mail servers like Gmail

It's never going to receive e-mail from an external service.

Unless you know to go to your router and change port 25.

No, it doesn't, the documentation doesn't have it in there.

It tells you all these other ports, but not port 25.

So you're having a quiet life for a few years to come receiving no

Hotmail instantly knows that you're sending it

It's what's called a dynamic address, because it changes.

Every time you turn your router on you get a new one.

It spots that and says, we don't accept e-mails

Because they just assume nobody's going to be running an e-mail server

So this box can't send an e-mail to Hotmail?

To any Hotmail address? No.

And if you try and send it to something like Gmail,

then what happens is, because of things like the way

Hotmail spots it, as you'll see there,

Spam House, which is one of biggest spam filters,

Now, to be fair, Nomx doesn't open port 25,

But as we've seen, without 25 open, it's going to be

difficult to hear from the rest of the world.

Well, bearing in mind it's got one job to do,

which is to be an e-mail server, that's a pretty poor show.

And there were more surprises to come when Alan opened the box.

One of the simplest machines to break into is a Raspberry Pi.

Everything is on this one little card.

It's on one of these tiny little cards.

So all of your e-mails, all of your software,

everything is running on one of these tiny little cards.

Now, actually, if somebody did have physical access to this

what they could do is they could whip that card out,

copy it, put the card back in, put it all back together

and you'd be none the wiser and they've got a copy

of everything, including your e-mail.

Because one of the things about this is it's not encrypted in any way

This is not using any encryption? For storage, none at all.

And what we did was, you said the simplest thing to do,

because it is a complete Raspberry Pi, the simplest thing

to do was actually plug it into a monitor and see what came up.

So this is an HDMI. HDMI cable.

The first concern would be if it is actually running

Raspberry Pi as an operating system, which it is, it immediately tells

Postfix is the mail transport agent, that's part of the mail server.

It was just all totally standard stuff.

So how old is the software on there at the moment?

Well, that's another thing that we found,

In that it's so old we couldn't actually get hold of some

It's running Raspberry Pi's own operating system.

It's a version called Wizi, which you can no longer download

They've taken it off because they don't want people

Likewise all this Postfix admin, there is another another piece

of software called Dovecot, all of which are free bits

of software, but some of it dates back to 2009.

It's inevitable that people will find bugs,

flaws, in any bit of software and what people do is they release

The problem with the way this is put together is there is no way

There is a whole series of things about the way this is put together

that make you think, absolute security is...

Now, it's important to say at this point,

there's nothing wrong with the hardware or the software

that you're talking about per se, Raspberry Pi is fine,

the software used, Postfix, Admin, is just a piece

Yeah, I mean, the Raspberry Pi is a great bit of hobbyist kit

as in the other programmes we have looked at, they do the job,

if you've got the latest versions of them.

They're still selling this box right now as a finished product?

It was being sold when you were testing it?

Absolutely, and as we're filming it is today.

OK, you've studied the box, what next?

Well, surprise, surprise, Scott thinks he can hack it.

I'm afraid because this is the short version of Click, we're going to

have to leave the story they're. If you want to know more details about

the hack and if you'd like to hear from Allen and Scott about what

happens after you hack a box like this you're going to have to watch

the full version, which is on iPlayer right now. Follow follow us

on Twitter too @BBCclick. Thanks for watching and we'll see you soon.