Serious Vulnerability In PGP And S/MIME E-Mail Encryption
A group of European researchers posted a warning on Twiter that the PGP/GPG and S/MIME email encryption included a group of serious vulnerabilities that can reveal the content of past (encrypted) messages to the attacker.
image source
With the details of the vulnerability, the researchers had previously informed the Electronic Frontier Foundation, which confirmed that it's a serious threat.
As a first step, it's recommended to disable automatic decryption of messages, that is, disabling PGP/GPG encryption in mail clients (e.g., Enigmail in the Thunderbird client, GPGTools in Apple Mail, Gpg4win in Outlook).
The authors also published a description of the vulnerability. There are two methods.
- The first method is direct exfiltration, where the attacker steals the contents of the encrypted message by an HTML image badge which is embedded in a properly prepared message.
- The second method is CBC/CFB Gadget Attack. It's an attack that exploits the specificity of Cipher Block Chaining encryption. The assumption of this attack is that an attacker knows at least one full block of plain text, which is not a problem in the given case since S/MIME encrypted emails usually begin with "Content-type: multipart/signed".
image source
As mentioned, the short-term solution is to disable encryption in the mail client and disable the HTML viewer, and the long-term solution will require the installation of appropriate updates (when available) and an upgrade of OpenPGP and S/MIME standards.
More details:
PSA: PGP and S/MIME email clients may leak encrypted emails
Attention PGP Users: New Vulnerabilities Require You To Take Action
Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels - full technical report
More security news:
Malicious Chrome Extensions Infected Thousands Of Computers
Master Key For Hotel Rooms
Internet Passwords Will Soon Be A History?
Does This Change Will Speed Up Your Internet?
5 Privacies You Didn't Know You Lost
Piracy Is Popular Like Never Before
Kaspersky Lab Joins Enterprise Ethereum Alliance
Slingshot - A State-Sponsored Malware
@seckorama
Thank you for sharing!
Most vulnerability’s seem to be fixed in thunderbird 52.7 nevertheless it will need 52.8 to fix every vuln.
As you mentioned it is important to disable html and show emails only in plain text.
At the moment the best practice seems to decrypt encrypted mails out of the mail client - like in CLI of GPG or so
Yes, you're right. No html and decrypt outside mail client.
Thanks for making me aware of this. It is hard to keep on top of security as technology continues to grow! I love your artwork by the way too!
Thank you, glad you like my artworks, too :)
very good article @sckorama, you are right in many things. You have incredible talent and ability ne the computer. God bless you.
Thank you :)