Posted on May 15, 2018 at 5:23 PM

New Encryption Flaw Can Allow Hackers to Access Secret Mail

Munster University of Applied Sciences’ researchers have uncovered a new flaw regarding the email encryption systems. If left unchecked, it would allow hackers to get access to users’ secret mail by several methods of infiltration.

New email-related vulnerability was found

Another big flaw was recently found by the researchers from the Munster University of Applied Sciences, and this one involves the systems used for email encryption. According to their report, the flaw was detected in S/MIME and PGP (Pretty Good Protection) technologies that are supposed to protect users’ emails.

According to researchers, the flaws include the way that clients use these protective plug-ins in order to decrypt emails based on HTML. Until the issues have been solved, users of these plug-ins are advised to disable them and switch to different message-encrypting clients.

The vulnerability in question is called EFAIL, and its method of operation includes the abusion of content that is deemed active in this type of emails. This includes page styles, images, and pretty much any other form of content that is not text-based. The issue is not as alarming as some might believe, due to the need for the hacker to already be in the possession of an encrypted email in order for an attack to work. Of course, it is still possible if the attacker manages to hack into the server containing the emails, or if they manage to eavesdrop on the correspondence between users.

Different methods of attack

There are several attack methods that the hacker might use in order to access the protected emails. The first one that is called “Direct Exfiltration”, and it works by abusing various vulnerabilities found in iOS Mail, Apple Mail, as well as those in Mozilla Thunderbird. If an attacker can make an email based on HTML that has three components (the S/MIME or PGP ciphertext, an image request tag, and the end of an image request tag) they might be able to send it to the targeted client.

The email client will, upon receiving the email, start deciphering the parts and combine them into one email. It will then convert the data into an URL, which will start with hacker’s own address. The URL will then receive a request to open the image, which basically doesn’t even exist. However, the hacker will receive this request, and a part of it will include the decrypted message in its entirety.

Another attack method carries the name of “CBC/CFB Gadget Attack”. This method relies on the specifications that S/MIME and PGP already have, which will lead to endangering all of the email clients. This, much more severe case, will have the attacker locate one of the blocks of the text that is encrypted and contained in an email that they managed to acquire.

Upon locating the block, the attacker will add another one, which is fake and filled with zeroes. After that, the image tag will be injected into the text, which would result in the creation of a new encrypted email body part. All that is left to do is for the victim to open the message, and the entire text would become visible to the attacker.

PGP and S/MIME users beware

These methods are only capable of affecting those who use S/MIME and PGP as their preferred method of email encryption. Those who do not use them are perfectly safe. However, there are many users of these plug-ins, which include individuals as well as companies. All who do use them should disable them immediately, and instead switch to another client. Android and iOS users might consider using Signal until this issue has been taken care of.

Also, due to EFAIL’s necessity to use emails based on HTML in order for these attacks to work, it is also highly advisable to disable HTML as well.

Researchers have also stated that this same vulnerability has the potential to also affect emails sent in the past. According to a tweet posted by Mikko Hypponen of F-Secure, PGP has been in active use ever since 1993, which is not very encouraging considering the discovered flaw.

This vulnerability might be used to decrypt the contents of encrypted emails sent in the past. Having used PGP since 1993, this sounds baaad. #efail

— Mikko Hypponen (@mikko) May 14, 2018

For now, the only solution is to thoroughly update the two plug-ins, but that is bound to be a difficult and lengthy process.