Serious Vulnerability In PGP And S/MIME E-Mail Encryption by seckorama

View this thread on: hive.blog | peakd.com | ecency.com

security · @seckorama · May 15 '18 (edited)

$2.15

Serious Vulnerability In PGP And S/MIME E-Mail Encryption

A group of European researchers posted a [warning on Twiter](https://twitter.com/seecurity/status/995906576170053633) that the PGP/GPG and S/MIME email encryption included a group of serious vulnerabilities that can reveal the content of past (encrypted) messages to the attacker.
<center>![skul1.jpg](https://steemitimages.com/DQmVCyFZ39YgbMACCN5EsqNLyzLpfpBFAk4YZjP7WSzrb3V/skul1.jpg)
*[image source](https://pixabay.com/en/ransomware-cyber-crime-security-2320793/)*</center>
With the details of the vulnerability, the researchers had previously informed the Electronic Frontier Foundation, which confirmed that it's a serious threat.

As a first step, it's recommended to disable automatic decryption of messages, that is, disabling PGP/GPG encryption in mail clients (e.g., Enigmail in the Thunderbird client, GPGTools in Apple Mail, Gpg4win in Outlook).

The authors also published a [description of the vulnerability](https://efail.de/). There are two methods. 
- The first method is direct exfiltration, where the attacker steals the contents of the encrypted message by an HTML image badge which is embedded in a properly prepared message.
-  The second method is CBC/CFB Gadget Attack. It's an attack that exploits the specificity of Cipher Block Chaining encryption. The assumption of this attack is that an attacker knows at least one full block of plain text, which is not a problem in the given case since S/MIME encrypted emails usually begin with "Content-type: multipart/signed".    

<center>![efail2.png](https://steemitimages.com/DQmY4CTPbcXMh3ELSkS18dJvQ5canHgBHNMP4P5vQcFtjvs/efail2.png)
*[image source](https://efail.de/media/smime-attack.png)*</center>

As mentioned, the short-term solution is to disable encryption in the mail client and disable the HTML viewer, and the long-term solution will require the installation of appropriate updates (when available) and an upgrade of OpenPGP and S/MIME standards.

More details:
[PSA: PGP and S/MIME email clients may leak encrypted emails](https://thenextweb.com/security/2018/05/14/psa-pgp-and-s-mime-are-broken-and-leaking-encrypted-emails-stop-using-them-right-now/)
[Attention PGP Users: New Vulnerabilities Require You To Take Action](https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now)
[Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels - full technical report](https://efail.de/efail-attack-paper.pdf)

More security news:
[Malicious Chrome Extensions Infected Thousands Of Computers](https://steemit.com/security/@seckorama/malicious-chrome-extensions-infected-thousands-of-computers)
[Master Key For Hotel Rooms](https://steemit.com/security/@seckorama/master-key-for-hotel-rooms)
[Internet Passwords Will Soon Be A History?](https://steemit.com/security/@seckorama/internet-passwords-will-soon-be-a-history)
[Does This Change Will Speed Up Your Internet?](https://steemit.com/privacy/@seckorama/does-this-change-will-speed-up-your-internet)
[5 Privacies You Didn't Know You Lost](https://steemit.com/privacy/@seckorama/5-privacies-you-didn-t-know-you-lost)
[Piracy Is Popular Like Never Before](https://steemit.com/piracy/@seckorama/piracy-is-popular-like-never-before)
[Kaspersky Lab Joins Enterprise Ethereum Alliance](https://steemit.com/security/@seckorama/kaspersky-lab-joins-enterprise-ethereum-alliance)
[Slingshot - A State-Sponsored Malware](https://steemit.com/security/@seckorama/slingshot-a-state-sponsored-malware)

<center>Enjoy the rest of the day!
![logosecko.gif](https://res.cloudinary.com/hpiynhbhq/image/upload/v1510949615/f4uqakvlsemsjuvj0lrb.gif)
@seckorama

[Take a look at my DTube Channel](https://d.tube/#!/c/seckorama)
[Check out my DSound Channel](https://dsound.audio/#/@seckorama)</center>

👍 nyh, qurator, btshuang, nokodemion, seckorama, vibrantyogini, security101, polm, fancynancy1, deepculture, akbarbadsha, yoyowhatsup, saranshtandon, beverages, slausonboy, ahidmuhajir, amri, jackie2017, infinitelearning, thepsychguide, abdelalii, henry-9ja, mostvulnerable, megalithic, randystiefer, zerocloo, kinkarkumar, reyha, sonofsatoshi, zapzap, laurasusannah, lpagents, jayfox, zemiatin, dometech, fbslo, faisalking, stanjames, wizzybright, anilkumar125469, rafiputra, manuel78, kabibitak, flodner, nikkisharma, pakhar, yadamaniart, saracampero, mwfiae, fishyculture, scrooger, ntowl, blacklux, theleapingkoala, lynncoyle1, devilonwheels, tab81177, redheadpei, starboye, malay11, karolisp, vaquita, ayay, starving

properties (23)

`author`	seckorama
`permlink`	serious-vulnerability-in-pgp-and-s-mime-e-mail-encryption
`category`	security
`json_metadata`	{"tags":["security","privacy","cybercrime","teamslovenia","steemitbalkan"],"users":["seckorama"],"image":["https://steemitimages.com/DQmVCyFZ39YgbMACCN5EsqNLyzLpfpBFAk4YZjP7WSzrb3V/skul1.jpg","https://steemitimages.com/DQmY4CTPbcXMh3ELSkS18dJvQ5canHgBHNMP4P5vQcFtjvs/efail2.png","https://res.cloudinary.com/hpiynhbhq/image/upload/v1510949615/f4uqakvlsemsjuvj0lrb.gif"],"links":["https://twitter.com/seecurity/status/995906576170053633","https://pixabay.com/en/ransomware-cyber-crime-security-2320793/","https://efail.de/","https://efail.de/media/smime-attack.png","https://thenextweb.com/security/2018/05/14/psa-pgp-and-s-mime-are-broken-and-leaking-encrypted-emails-stop-using-them-right-now/","https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now","https://efail.de/efail-attack-paper.pdf","https://steemit.com/security/@seckorama/malicious-chrome-extensions-infected-thousands-of-computers","https://steemit.com/security/@seckorama/master-key-for-hotel-rooms","https://steemit.com/security/@seckorama/internet-passwords-will-soon-be-a-history","https://steemit.com/privacy/@seckorama/does-this-change-will-speed-up-your-internet","https://steemit.com/privacy/@seckorama/5-privacies-you-didn-t-know-you-lost","https://steemit.com/piracy/@seckorama/piracy-is-popular-like-never-before","https://steemit.com/security/@seckorama/kaspersky-lab-joins-enterprise-ethereum-alliance","https://steemit.com/security/@seckorama/slingshot-a-state-sponsored-malware","https://d.tube/#!/c/seckorama","https://dsound.audio/#/@seckorama"],"app":"steemit/0.1","format":"markdown"}
`created`	2018-05-15 15:59:12
`last_update`	2018-05-15 16:13:45
`depth`	0
`children`	6
`last_payout`	2018-05-22 15:59:12
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	1.934 HBD
`curator_payout_value`	0.219 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	3,784
`author_reputation`	681,351,390,756,697
`root_title`	"Serious Vulnerability In PGP And S/MIME E-Mail Encryption"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	55,849,359
`net_rshares`	436,816,161,759
`author_curate_reward`	""

vote details (64)

voter	rshares	pct
jayfox	3,434,029,638	100%
seckorama	17,947,315,274	100%
btshuang	57,774,427,211	100%
yadamaniart	285,078,211	1.05%
amri	3,992,219,475	100%
thepsychguide	3,874,462,466	100%
malay11	54,215,613	1.05%
manuel78	1,126,568,047	15%
scrooger	152,536,656	0.31%
nyh	86,865,398,363	43%
blacklux	132,487,178	0.25%
yoyowhatsup	4,285,883,345	100%
starving	51,060,280	100%
faisalking	2,724,228,362	100%
theleapingkoala	131,196,299	0.52%
flodner	921,529,637	100%
infinitelearning	3,889,103,609	100%
fishyculture	196,607,743	1%
randystiefer	3,720,665,937	100%
fbslo	2,739,949,434	100%
starboye	57,705,516	100%
qurator	68,523,163,356	2.1%
nikkisharma	639,341,081	14%
henry-9ja	3,833,305,950	100%
akbarbadsha	4,344,360,657	100%
karolisp	53,947,906	0.02%
laurasusannah	3,483,742,707	100%
ahidmuhajir	4,029,614,537	100%
reyha	3,574,300,500	100%
nokodemion	53,468,226,928	100%
abdelalii	3,859,291,057	100%
mostvulnerable	3,810,332,693	100%
sonofsatoshi	3,503,922,521	100%
jackie2017	3,923,630,465	100%
kabibitak	997,631,760	100%
pakhar	297,105,200	12%
stanjames	2,554,345,366	100%
devilonwheels	99,727,593	0.02%
tab81177	91,586,794	15%
lynncoyle1	111,234,200	0.52%
anilkumar125469	2,113,455,584	100%
dometech	3,303,472,995	100%
beverages	4,127,421,070	100%
security101	7,733,653,980	15%
lpagents	3,451,234,292	100%
saranshtandon	4,167,855,488	100%
rafiputra	1,637,934,669	100%
slausonboy	4,039,865,347	100%
redheadpei	79,200,940	5%
zemiatin	3,312,614,330	100%
mwfiae	226,724,289	0.21%
ayay	51,483,355	13%
fancynancy1	4,433,319,143	100%
deepculture	4,418,545,108	100%
saracampero	267,414,852	100%
megalithic	3,725,947,393	100%
kinkarkumar	3,600,095,412	100%
zapzap	3,488,919,928	100%
vibrantyogini	16,243,383,868	100%
ntowl	134,165,294	0.42%
wizzybright	2,510,386,093	100%
vaquita	53,108,506	100%
polm	4,487,330,602	100%
zerocloo	3,653,149,656	100%

@saracampero · May 16 '18

very good article @sckorama, you are right in many things. You have incredible talent and ability ne the computer. God bless you.

properties (22)

`author`	saracampero
`permlink`	re-seckorama-serious-vulnerability-in-pgp-and-s-mime-e-mail-encryption-20180516t084621049z
`category`	security
`json_metadata`	{"tags":["security"],"users":["sckorama"],"app":"steemit/0.1"}
`created`	2018-05-16 08:07:45
`last_update`	2018-05-16 08:07:45
`depth`	1
`children`	1
`last_payout`	2018-05-23 08:07:45
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	129
`author_reputation`	202,123,147,213,699
`root_title`	"Serious Vulnerability In PGP And S/MIME E-Mail Encryption"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	55,968,389
`net_rshares`	0

@seckorama · May 16 '18 (edited)

Thank you :)

properties (22)

@security101 · May 15 '18

Thank you for sharing! 
Most vulnerability’s seem to be fixed in thunderbird 52.7 nevertheless it will need 52.8 to fix every vuln. 
As you mentioned it is important to disable html and show emails only in plain text. 
At the moment the best practice seems to decrypt encrypted mails out of the mail client - like in CLI of GPG or so

👍 seckorama

`author`	security101
`permlink`	re-seckorama-serious-vulnerability-in-pgp-and-s-mime-e-mail-encryption-20180515t161452750z
`category`	security
`json_metadata`	{"tags":["security"],"app":"steemit/0.1"}
`created`	2018-05-15 16:14:51
`last_update`	2018-05-15 16:14:51
`depth`	1
`children`	1
`last_payout`	2018-05-22 16:14:51
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	333
`author_reputation`	1,496,739,907,691
`root_title`	"Serious Vulnerability In PGP And S/MIME E-Mail Encryption"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	55,851,868
`net_rshares`	4,258,684,980
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
seckorama	0 B		4,258,684,980	24%

@seckorama · May 15 '18

Yes, you're right. No html and decrypt outside mail client.

👍 security101

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
security101	0 B		2,677,034,070	5%

@vibrantyogini · May 16 '18

Thanks for making me aware of this. It is hard to keep on top of security as technology continues to grow! I love your artwork by the way too!

👍 seckorama

`author`	vibrantyogini
`permlink`	re-seckorama-serious-vulnerability-in-pgp-and-s-mime-e-mail-encryption-20180516t085833683z
`category`	security
`json_metadata`	{"tags":["security"],"app":"steemit/0.1"}
`created`	2018-05-16 08:58:33
`last_update`	2018-05-16 08:58:33
`depth`	1
`children`	1
`last_payout`	2018-05-23 08:58:33
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	142
`author_reputation`	1,573,513,250,459
`root_title`	"Serious Vulnerability In PGP And S/MIME E-Mail Encryption"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	55,974,398
`net_rshares`	2,282,952,402
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
seckorama	0 B		2,282,952,402	12%

@seckorama · May 16 '18

Thank you, glad you like my artworks, too :)

properties (22)