Critical vulnerabilities make it possible to read the mails encrypted by OpenPGP or S / MIME

Researchers have shown that rendering HTML in email clients can extract decrypted content from an email when it is read. The software of Apple, Microsoft or Mozilla are concerned.

Red alert in the security of e-mails. A group of researchers found critical loopholes in the two main message encryption systems in use, OpenPGP and S / MIME.

As a reminder, these two systems rely on symmetric and asymmetric encryption algorithms - AES and RSA, for example - to ensure end-to-end confidentiality between a transmitter and a receiver.

At the mainstream level, the most well-known technology of both is OpenPGP that can be used with any email client. Just install the software plugin or the appropriate browser extension: Enigmail, GPGTools, Gpgf4win, Mailvelope, etc. Some service providers have also integrated it directly into their offers. This is the case, for example, with ProtonMail and GMX Caramail. S / MIME techno is used only in enterprise because it requires a hierarchical infrastructure to distribute certificates to users.

Two variants of attacks

The researchers did not intend to reveal the details of these flaws until tomorrow morning. However, it turns out that their scientific paper and their explanations are already available on the efail.de website.

Called "EFAIL", the attack principle is as follows: an attacker intercepts encrypted emails, integrates some HTML tags, and sends them to the recipient. At the moment when the latter decrypts them in his mail client, the decrypted text is returned to the attacker thanks, precisely, to these HTML tags.

This extraction channel can be constructed in two ways. In the first case, the ciphertext is simply embedded in an image tag. The decrypted text will then be interpreted by the mail client as part of an HTML image request and sent in clear to the attacker. Of the 47 email clients tested, 17 are vulnerable to this type of attack, including Apple Mail (macOS), Mail App (iOS), Thunderbird (Windows, MacOS, Linux), Postbox (Windows) and MailMate (macOS).

The second case is similar, but technically much more complicated. This time, the attacker injects his tag directly into the ciphertext by relying on vulnerabilities found in the cryptographic standards used by PGP / GPG and S / MIME, namely the CBC and CFB block cipher modes. The HTML tag will only appear after decryption, creating the extraction channel. Out of 35 email clients tested, 23 are vulnerable through S / MIME and 10 through PGP / GPG.

No patch is available at the moment. In the meantime, there are fortunately workarounds, starting with the disabling of HTML mode in email clients. Alternatively, disable decryption in the email client. In this case, the user will have to copy-paste the encrypted content into another decryption application that does not render HTML. Those who do not want to take the lead can also simply abandon the email and use more modern end-to-end encryption messaging like Signal or Telegram.

Finally, the exploitation of these flaws is also not within reach of the first hacker come, according to Bruce Schneier, a cryptographer emeritus. "Being able to intercept and modify e-mails in transit is the kind of thing the NSA can do, but it's hard for the average hacker," he says in a blog note.

paypal,facebook,yahoo,mail,google,maps,ebay,amazon,barcelone,realmadrid,netflix,craigslist,AliCarter,Liverpool,AlfieEvans,YankeesVsAngels,RonanFarrow,YeVsThePeople,MesotheliomaLawFirm,Donate,CarToCharity,California,Donate,Car,ForTaxCredit,DonateCarsInMa;Insurance,Loans,Mortgage,Attorney,Credit,Lawyer,Donate,Degree,Hosting,Claimcashfear,softwares,money,football,SPORTNEWS,cars,carrental,cellphone,phonenumber,forex,torrent,voip,net,adsence,tollsspeakers,tipsspeakers,iphonespeakers,phones,iphone4,facebook,youtube,twitter,livematch,newslive,watchmatchforfree,watchlaligaforfree,watchserieAliveonjsc+,softwares,football,SPORTNEWS,cars,carrental,cellphone,phonenumber,forex,torrent,voip,net,adsence,tollsspeakers,tipsspeakers,iphonespeakers,phones,iphone4,facebook,youtube,twitter,livematch,newslive,watch match for free,watch laliga for free,watch serie A live on jsc+,windows 7,windows 8