Critical flaw found in email encryption tools

В самом популярном способе шифрования нашли дыру

However, there is some debate as to how serious the issues are.

The security flaws in both the standard were discovered by a group of researchers in Europe.

Unlike PGP, S/MIME (Secure/Multipurpose Internet Mail Extensions) is an email-only encryption program.

A research team of nine academics from the Electronic Frontier Foundation has discovered critical vulnerabilities in two email encryption tools. While doing so, the client loads any external content, thus, exfiltrating the plaintext to the attacker.

According to a tweet from Schinzel, the vulnerabilities "might reveal the plaintext of encrypted emails, including encrypted emails sent in the past". "This creates a single encrypted body part that exfiltrates its own plaintext when the user opens the attacker email". This new vulnerability allows hackers and attackers the ability to read encrypted HTML emails in plaintext files. Explore practical tips you can implement to reduce the risk of a successful email attack in this whitepaper. Attacks using the EFAIL vulnerability take advantage of "active content" in HTML emails, such as externally loaded graphics, to extract the plain text through those requested URLs. They warn that the flaw won't be fully fixed until the IT community updates the PGP and S/MIME standards. If it's not, GnuPG returns an alert.

A threatening flaw in email encryption was revealed Monday in a report from European researchers.

This is possible because of a basic flaw of end-to-end encryption, they add.

Sunny Monday expected, possible thunderstorms in the evening
There is a slight chance of showers and storms for the KVOE listening area by late afternoon with a better chance around sunset. According to the National Weather Service in Hastings, Grand Island received 0.28 of an inch of rain from the storm.

Koch says some MUAs' failure to block hidden HTML links are the problem.

His colleague Robert Hansen said on Twitter that the issue had been known about for some time.

Users of platforms that use S/MIME and PGP encryption have been advised to disable email encryption to avoid the chances of an attack. "It seems to not be easily reproducible in all cases".

An attacker could gain access to encrypted emails by monitoring network traffic, compromising email servers or the computers of users, or gaining access to backup servers. "Given the current state of our research, the CFB gadget attack against PGP only has a success rate of approximately one in three attempts".

Indeed, El Reg recommends opening PGP-encrypted emails in a text editor on a secured virtual machine, host, or container, depending on your level of paranoia, rather than allow encrypted HTML messages to be parsed and rendered.

"Email is no longer a secure communication medium", Sebastian Schinzel, a professor of computer security at Germany's Münster University of Applied Sciences, told the German news outlet Süddeutschen Zeitung. "In fact OpenPGP is immune if used correctly while S/MIME has no deployed mitigation", the expert said. They have published guides for Thunderbird, Apple Mail, and Outlook.

Email users who use PGP (based on OpenPGP) and S/MIME to encrypt and decrypt their communications are at "immediate risk".

Related News:



Most liked

Govt seeks Aramco, Adnoc backing for $44 billion oil refinery
ADNOC's new strategy is expected to create more than 15,000 jobs and contribute 1% to UAE GDP growth. India-UAE Relations have zoomed to the highest possible level under Indian PM Narendra Modi .

Nick Young credits dream about Steve Kerr for solid Game 1 showing
Luc Mbah a Moute did not help the Rockets off the bench. "You've got two great scorers over there in [ Chris Paul ] and James". Golden State undoubtedly has a sizeable advantage with Klay Thompson and Draymond Green in the starting lineup.

A Sports Book Is Coming To A Betting Parlor Near You
In 2011, voters in New Jersey approved a ballot measure legalizing sports betting, hoping to revive their state's gaming industry. Critics have raised fears that legalized gambling could make "points shaving" or other forms of corruption more prevalent.

Cpl. Middlebrook to be honored in Washington DC
A procession of police officers will walk down Memorial Drive beginning at 7 p.m. 559 of those officers are from North Carolina. He called on his department's recruits to "remember those who have fallen, and honor them by serving your community well".

100 points, record wins, record goals - Manchester City's incredible Premier League season
There were wonderful scenes soon after as Liverpool's fans cheered Salah's daughter, Makka, as she kicked a ball on the field. With a 19-point advantage over United, City outperformed their rivals' 1999-2000 margin of 18 over Arsenal .

Zverev, Thiem To Fight For Masters 1000 Glory
He was adamant the result of Rome won't affect his preparation for the French Open. "Of course I am disappointed", Nadal said. Zverev also won four consecutive times last week at the BMW Open by FWU in Munich to celebrate his first title of the year.

Liverpool favourite Peter Crouch predicts three-way Premier League title race next season
But he admits De Gea's growth has been phenomenal to watch and indicated that his brilliance between the sticks has shielded some shoddy defending from Manchester United .

Hamas Chief Visits Cairo a Day Before US Relocates Embassy to Jerusalem
Israel captured east Jerusalem in the 1967 Mideast war and annexed it in a move not recognized internationally. Since late March, 42 Palestinians have been killed in weekly clashes with Israel along the Gaza border.

The Players Championship leaderboard: Scores, highlights from Round 4 at TPC Sawgrass
He ended the front nine with a 15-foot birdie putt on the par-five ninth for a one-shot lead, and then he took off. I wanted to hit away from the pins unless I had a sand-wedge in my hand, and I did that well.

Pep identifies the team to watch in the league next season
Manchester City have their eyes on another century as they aim to wrap up their outstanding season with a flourish. City's 105 goals and 31 wins are also Premier League records that could be increased further this weekend.

May, Trump plan talks over Iran sanctions
Boosting output to compensate for Iran and reining in rising prices would prevent damage to the global economy, and fuel demand. Zanganeh said Iran's crude production was about four million barrels per day (bpd), nearly four percent of global output.

Macron calls friend Trump, angry over his Iran nuclear move
That would be a good thing - while we're talking, we're not shooting - and Trump would have achieved something worthwhile. White House spokeswoman Sarah Huckabee Sanders issued a statement citing actions in Syria and Saudi Arabia.

Seattle Mariners vs. Detroit Tigers, 5/12/2018 Prediction & Odds
Castellanos got hit in his left hand with a pitch Saturday and the team is calling it a "finger contusion". Cano is batting.287 with four home runs and 23 RBIs this season for Seattle.

China's First Home-Built Aircraft Carrier Started Sea Trials
The US is the largest operator, with 11 nuclear-powered carriers, each having a full-load displacement of about 100,000 tons. Now the country only has a retrofitted Soviet-era aircraft carrier called the Liaoning , which was launched in 2012.

US Military Jets Intercept Russian Bombers Off Alaskan Coast
A pair of US fighter jets intercepted two TU-95 bombers, similar to the one pictured here, Friday morning off the Alaskan coast. Russia's state-run news agency TASS said the U.S. jets did not come within "100 metres" of the Russian aircraft.