Slashdot Mirror
Attention PGP Users: New Vulnerabilities Require You To Take Action Now (eff.org)
A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. From a report: EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages. The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific).
In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication. Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email. Further reading: People Are Freaking Out That PGP Is 'Broken' -- But You Shouldn't Be Using It Anyway (Motherboard).
In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication. Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email. Further reading: People Are Freaking Out That PGP Is 'Broken' -- But You Shouldn't Be Using It Anyway (Motherboard).
Isn't this supposed to be a peer reviewed...
Yes... which is how we know about the problem and can address it. Open Source isn't magic.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
In other news, lock picks can be used to open up your model of door lock. We advise you to remove all door locks from your door until a lock pick proof lock can be engineered and installed.
The problem is the clients decrypt, then process any external requests for content. So if you can re-send an encrypted email with an external content request added to it, the client will happily decrypt then send the content request with your precious decrypted content. If you globally disable fetching any external content you don't have to worry. The encryption protocols all work fine, it is the behavior of the clients after the decryption that is the problem. So S/MIME would be affected too, or potentially any other encryption tool. Refusing to load any external content under any circumstances is good advice anyway.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Isn't this supposed to be a peer reviewed protocol that was guaranteed to be secure? How long has this program existed? Holy shit.
The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
PGP is broken now? It's only had fairly infrequent and minor issues over time. If this is broken now, then it's the final sign that anyone who thinks computers can be secured is wrong. If you want something secure, write it down in a notebook. It'll be about 100x more secure than putting it on a computer simply by not being networked. Even if someone steals and reads your notebook it's better than someone having it on their phone (or PGP, now I guess) for the ENTIRE WORLD to come along and steal. Computers are great for games, everything else is debatable.
then why are you using PGP? It is only used by criminals and the like.
Yes, indeed, some advice there. Because there is some potential for bad actors to possibly decrypt some of the PGP encrypted messages, if said messages include HTML with links to 3rd party sites (which your email client must display automatically), you need to **completely disable** email encryption. Then all of your email becomes clear text and, fully readable by anyone without effort, and thus you are completely safe from that vulnerability. SMH.
That wonderful advice is brought to you by researchers in no way sponsored by NSA or any other 3 letter agency.
For those worried - make sure your email client does not automatically display any embedded HTML links (or, better yet, just turn off HTML formatted email). I believe this is the default for Enigmail encrypted email anyway. Use plaintext, and you are as safe as cryptography allows. (I believe Enigmail authors posted a message to that effect).
I'm no security expert, but allowing HTML mail to arbitrarily download embedded graphics in a mail client is just dumb. From my reading of the articles, doing that doesn't disable the problem, but keeps the information from escaping back to the malicious parties. This is a mail client problem triggering PGP to decrypt, then allowing the information to escape through embedded graphics, not a fundamental problem in PGP itself. Turning off HTML mail support at the client and just taking the text representation of the message looks like it completely defeats the hack. Tell me if I'm wrong.
PGP and S/MIME. (!?) Thunderbird and Apple Mail and Outlook. Weirdly, they don't mention GnuPG by name but it is strongly implied ("tools that automatically decrypt PGP-encrypted email").
It looks like a bunch of things that seemingly share no code, unless it's some fundamental library or something that got copied a lot. Maybe a buffer overflow in some shared RSA or DH decryption library?
From https://lists.gnupg.org/piperm... :
> 1. This paper is misnamed.
Indeed
> 2. This attack targets buggy email clients.
Exactly
> 3. The authors made a list of buggy email clients.
Well said.
The MUA should not allow *any* utilization of HTTP when rendering a HTML E-mail. Any form of doing that is a serious mistake. Not only because of what is reported here, but also because that way *that* use of HTTP will allow spammers to identify when you open the E-mail. They use that to know if your E-mail adress is still alive.
Serious MUAs don't do this without user consent. Most HTML components even have a explicit offline mode exactly for that reason. Meaning that they won't automatically go online and fetch things like the src url of an IMG.
Any MUA that does this without user consent is completely and utterly wrong. Especially in a security sensitive context. This is something most MUA developers know about and if not, should know.
Better mod this up because a lot of people will be getting this wrong.
What might be common sense for us is certainly not for newcomers to PGP or those being made to use PGP in a corporate environment as part of a 'best practice'
when you're sending a PGP message, it needs to be plaintext. HTML is simply too dangerous to be disarmed in every conceivable application. This means your email messages should be read in plaintext for PGP.
I also think the EFF is a bit paranoid in issuing a 'full stop' to using PGP until this is fixed. At worst, you should send a link to the PGP document you'd like the user to read (in plaintext of course.)
Good people go to bed earlier.
Sounds like just what the spies would like you to do to gain temporary access to most communications that used to be encrypted, while disabling some of them...
In Soviet Washington the swamp drains you.
Seriously - there’s no good reason for an email which is important enough to encrypt to include html or other “rich formatting” anyway. Just turn it all off.
#DeleteChrome
I only wish I were using PGP. I can't get others to take encryption seriously enough to deal with the hassle of using it.
Here's to the day it is baked into mail programs in such a way that my program will send a query to public registry or their program and gets their public key just by checking a box before sending an email (or make it the default). But most importantly, mine and their keys were generated whether or not we ever use them. Yeah, there's still man in the middle weaknesses. But it's better than nothing. You'd be able to send Grandma an encrypted email (and maybe visa versa) without her even knowing diddly about encryption.
PGP is broken now? It's only had fairly infrequent and minor issues over time. If this is broken now, then it's the final sign that anyone who thinks computers can be secured is wrong. If you want something secure, write it down in a notebook. It'll be about 100x more secure than putting it on a computer simply by not being networked. Even if someone steals and reads your notebook it's better than someone having it on their phone (or PGP, now I guess) for the ENTIRE WORLD to come along and steal. Computers are great for games, everything else is debatable.
PGP is not broken. The way a few bad email clients are using it is broken. If you are not using Thunderbird you are safe with PGP. While S/MIME is comprised in every email client except modern Outlook, KMail, and mutt.
We fear that the PGP software stores hiddenly the password of the user in the PGP-encrypted message.
It does not appear only in PGP, it includes too SSL, TLS, etc.
By example, if the pure encrypted message occupies 10000 bytes then it will include 200 bytes somewhere hidden for the resulting 10200 bytes of the final encrypted message.
I request a new investigation to this fear.
No. PGP is probably fine. It's that some email clients with HTML email enabled and automatic decrypt enabled open an attack vector for some reasons. The EFF promises the details will be coming soon.
I also think the EFF is a bit paranoid in issuing a 'full stop' to using PGP until this is fixed. At worst, you should send a link to the PGP document you'd like the user to read (in plaintext of course.)
The EFF said no such thing; they recommended uninstalling or disabling widgets that *automatically* decrypt in the MUA.
>Immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email!
So to fix this, just disable HTML mail and use plain test email. Right?
PGP is not broken as crypto.
Either stop PGP from automatically decrypting, and transfer the encrypted text to PGP for decrypt outside the mail client.
OR, disable html in the mail client, use plain text mail (as I think Snowden recommended years ago).
Isn't this supposed to be a peer reviewed protocol that was guaranteed to be secure? How long has this program existed? Holy shit.
The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
And only for HTML emails, and only in Thunderbird, Apple Mail, Postbox and Airmail. So if you are using a better email client especially a non-Mac one you are fine.
No. You should read the first link.
This is all situations where the simply act of reading an email causes the mailreader to send a request for an external resource, i.e. html emails. Everyone who cares about security already told their mailreaders to stop doing shit like that back in the 1990s. We're talking about a situation where people already have a problem even if they're not using PGP.
My understanding of this is that it applies only to HTML email - if you are using S/MIME and PGP/GnuPG with text-only emails, you should be fine. So why are EFF calling for disabling all PGP and GnuPG?
Finding God in a Dog
Not..
This vulnerability affects those who have no idea how to use encrypted emails. HTML is not to be used in encrypted emails, neither is external references. In fact anyone who is versed in the secure use of email has any and all external references disabled. I do not care for your fancy font or for the background wall paper, If you refuse to attach any pertinent images directly to the email then they are not worth my time. Email is meant to be used as a direct method of communication, only the relevant portions need to be included and font and color are not relevant.
Personally i blame Microsoft for trying to get the masses to adopt email, if they had just left well enough alone then we wouldn't have half of the problems we do today.
In other words, disable HTML rendering in your email client, and check for other external referencing stupidity it might have. All of which shouldn't be in your client in the first place. So get a better client.
Which again means that the problem isn't in PGP/GPG, and the "security" "researchers" are much busier drumming up hype than they're doing useful work. Which is par for the course in s'kiddie-land. But we already knew that too, of course.
The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
And only for HTML emails, and only in Thunderbird, Apple Mail, Postbox and Airmail. So if you are using a better email client especially a non-Mac one you are fine.
According to the EFF notice, it also affects Outlook with the GPG4win plugin. Outlook also has builtin S/MIME checking, and oddly, that's been throwing errors on the signed emails I'm getting from the ClamAV list this morning...
I blame the alarmist summary!
Fuck that guy!
If you have nothing to hide... then why are you using PGP? It is only used by criminals and the like.
Ha, ha.
But seriously. If you have nothing to hide, do all your communication with your bank, mortgage holder, broker, 401(k) administrator, and doctor solely by postcard. And take the shades off your windows.
Law-abiding people have PLENTY to hide. And they have a RIGHT to hide it. The Fourth Amendment, among other parts of the constitution, explicitly recognizes this, and the Supreme Court has issued a ruling making explicit and binding an easy-to-understand "Right to Privacy" interpretation of a combination of several pieces of the Constitution.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
This all goes back to really stupid features being added to email. There is no good reason to load external resources into an email. Want to include an image in your email? Go for it, but include it in the email. Why the hell would an external image get automatically loaded in an email that I downloaded for offline reading?!?! If it's external, just provide a link to it. Hell, just get rid of HTML email altogether!
The CBC "gadget" vulnerability seems kinda scary (see https://efail.de/), but I'm fairly certain that a signed and encrypted message would identify these (modifying the encrypted message via CBC gadget will break the message signature). While one *can* send an encrypted message that is not signed, that's never actually done. So, if you get an encrypted message that is not signed, that set off an alarm in the email client and lock down that message (sandbox it).
This is 100% the fault of the email client implementations. FWIW, if you still use mutt or pine or alpine etc, you're safe for now. They did mention other backchannels, but didn't name any... maybe more will be disclosed on that later?
This could be misunderstood -- the whole point of the attack is that the attacker changes a non-HTML email into an HTML one. If your mail client doesn't support HTML (or displays the formatting but doesn't fetch anything) then you're fine.
This isn't correct.
There are two bugs. One is a sort of braindead one which only affects a small number of clients (including Thunderbird and Apple Mail), and has nothing to do with PGP or SMIME.
The other one is more serious, and does have to do with SMIME and PGP. Basically, if an attacker has a copy of an email which is encrypted but not signed, and knows what some of the plaintext is exactly, she can splice out those bits and put in other bits. And basically all e-mails contain things like Content-type: text/plain. So, an attacker can modify that to Content-type: text/html\n\n <img src=.
Regarding this bug, the website says:
I agree that it's a bug for MUAs to automatically download external content in encrypted emails. But it's a much more understandable bug to make.
TCP: Why the Internet is full of SYN.
Nobody said open source is a panacea to make software secure, bit it *is* a prerequisite for a user to verify that a piece of software is secure. It's like politicians that don't reveal their tax returns: those that don't do it aren't necessarily crooked, and those that do aren't necessarily honest. But one of the criteria for being certain that they're honest is to be able to audit those returns.
Draft of the paper to be released tomorrow here: https://efail.de/efail-attack-paper.pdf
It's going to impact all 15 people in the world using PGPed email!
Either some didn't read the entire article or don't understand the need for authenticated encryption.
The issue the EFF is concerned about is that the OpenPGP spec doesn't mandate authenticated encryption and doesn't specify what to do if authentication fails.
The authentication tag could be as simple as the HMAC of the encrypted message using the symmetric key as the HMAC "secret". Attackers can't create provide a modified message that could be authenticated without knowing the shared key.
Have the minimum AES mode be GCM or other AEAD encryption modes such as ChaCha20-Poly1305.
The standard needs at least two new SHALLs 1) All encryption modes shall be AEAD. 2) Decryption process shall immediately stop if authentication fails and no part of the message is presented to the user.
You're asking for people to know vulnerabilities before the proof-of-concept attacks even are *invented* by security researchers. You can't do that in *any* kind of software development whatsoever.
Might as well just keep offline, because there's no 100% secure piece of software! /s
There's always a level of risk to any piece of software, from remote attackers or exploits that give an in-person attacker root privileges. We can't give up on software, all we can do is have people watching and learning, which is better than having none at all, or having security researchers going to jail for simply telling the truth about closed source software vulnerabilities.
At least researchers are not legally punished for investigating exploits in open source software, which creates incentive to actually check the software instead of naively assuming the best.
The EFF is looking to advise dummies (ie. average Joe/Jill/Zilla who doesn't know anything about what they're doing on a computer on average). They want to spread info that will work in securing things without it being too hard for people to actually do.
The more in-depth reasoning and actions will always be sought out by anyone who *isn't* that kind of user.
https://lists.gnupg.org/piperm...
3 strawmen in one post? Wow we got a record boys.
Nothing, and I mean literally NOTHING, is guaranteed to be secure. Nice strawman. Then you reply and post 3 more strawmen.
Jesus, Mary and Joseph. Someone give this guy a cookie.
This is 100% the fault of the email client implementations.
No, it isn't. Its yet another open source failure. Many eyes.. haha
It absolutely IS the fault of email clients. PGP/GPG doesn't go out and load remote content.
The cesspool just got a check and balance.
Let's see, that makes 5 strawmen from you now. 1 in the original post, 3 in your first reply, and now another one in this reply. Smh.
Apple Mail is fine, and I'm sure others are too, if you turn off "Load remote content". I did that a while ago because it's one of the ways FB and Google both track you.
The cesspool just got a check and balance.
PGP is broken now? It's only had fairly infrequent and minor issues over time. If this is broken now, then it's the final sign that anyone who thinks computers can be secured is wrong. If you want something secure, write it down in a notebook. It'll be about 100x more secure than putting it on a computer simply by not being networked. Even if someone steals and reads your notebook it's better than someone having it on their phone (or PGP, now I guess) for the ENTIRE WORLD to come along and steal. Computers are great for games, everything else is debatable.
PGP is not broken. The way a few bad email clients are using it is broken. If you are not using Thunderbird you are safe with PGP. While S/MIME is comprised in every email client except modern Outlook, KMail, and mutt.
If you are using Thunderbird and you have disabled loading remote content in messages (which you should be doing anyway) then this issue (which relies on automatic execution of embedded remote URLs) won't affect you. HTML emails are the real problem here.
And really has not much to do with PGP/GnuPG either, it is about the insane HTML integration in email software that can leak data if external resources are loaded automatically and, apparently, your email is decrypted automatically. If you have either of these, your security has gone out of the window long before the present issue was discovered. Also seems to require a broken MIME parser. Hence this is an issue with mailers, not with PGP/GnuPG (or rather the OpenPGP format). Pretty much the same screw-up by email software makers also affects S/MIME, only it suffers from missing authenticated encryption in addition.
Bottom line, a sane set-up that only renders HTML (or refuses it completely like I used to, these days I convert it to text with lynx), but does not fetch/execute anything should be safe from this. And yes, you should definitely use PGP/GnuPG, despite what some people say.
The other bottom line is that many people making email software have really, really screwed up here. The makers of PGP/GnuPG have not.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
PGP is very much _not_ broken. Some wannabee mail software is badly broken in how it handles HTML, MIME and PGP integration. This is also not a surprise at all. There is a reason many of us still use mutt or elm or the like at least for encrypted email.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Nothing is "guaranteed to be secure". Incidentally, it is not PGP or GnuPG that is at fault here. It is fundamentally broken and insecure HTML and MIME parsing in the email software affected. PGP/GnuPG is perfectly fine.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This is 100% the fault of the email client implementations. FWIW, if you still use mutt or pine or alpine etc, you're safe for now.
Oh, yes. Mutt user here (at least for encrypted email), because I have never trusted these messed up insecure jokes that pass for email software these days. Automatically loading stuff from external places in this way is an instant security fail. Nobody with a clue is surprised this can be exploited.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
PGP/GnuPG also does no MIME parsing, which must be broken as well to allow the attack. This is 100% incompetent implementation of email software by people that are clueless about security.
I also have to say I find all the alarmists here a disgrace. Clueless, arrogant and panicky, a very bad combination.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Exactly the kind of reaction the researchers were hoping for so as to get their 24 hours of fame.
In the end the problem isn't broken PGP or S/MIME at all, but stupid implementation of Mail User Agents and their poor handling of MIME multipart messages. i.e.: they can start a HTML img tag in a subpart before an encrypted subpart, finish it in a following subpart and be able to exfiltrate the encrypted subpart (now decrypted) via HTTP requests.
Apple Mail is fine, and I'm sure others are too, if you turn off "Load remote content". I did that a while ago because it's one of the ways FB and Google both track you.
True, but it really should be default off, and be warned against turning on.
Auto decryption is convenient but makes the system weaker.
Why does this post make me sure you're the one who wrote it?
A lot of security flaws arise from someone wanting to improve the "user experience". We've known almost forever that convenience the enemy of security.
> The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
Apparently thats wrong; it seems that core vulnerabilities lie inside the use of the gpg and smime protocol implementations themselves.
In particular, the lack of a valid message digest, and the default behavior of returning decryption results (or even attempting decryption) when the digest is invalid is the core problem.
If tampered encrypted payloads are detected, *decryption must not be attempted*
It seems over gnupg is vulnerable to this attack.
> is not PGP or GnuPG that is at fault here
They are at fault for violating the "enc then mac" principle.
They should not return decrypted content of tampered messages, and if they didnt the gadget weakness would not exist.
This is absolutely a crypto issue in addition to an email client issue.
I do this and I don't even use PGP. It's like a built in no-script feature as far as I'm concerned. Only loads local stuff and then I just go to whatever website the email is about. Don't need to click links in emails.
if you still use mutt or pine or alpine etc, you're safe for now.
PINE? What about elm? You know, that thing that PINE is not ...
PGP is not broken. Look it's really simple kids, stop using software that does stupid things like automatically opening attachments. You've been warned for literally decades.
Any sane IT department should be disabling at the very least, js in emails. Preferably BAN HTML period though I s'pose "basic" HTML is a middle ground.
The headline should be "outlook users still click on emails".
The more fucked up thing about this is with S/MIME and CA certs that are trusted to execute CODE. It's not an attack surface limited to PGP though.
Isn't this supposed to be a peer reviewed protocol that was guaranteed to be secure? How long has this program existed? Holy shit.
well.. as far as I know... all encryption have allegedly been rendered useless by NSA long ago... so it is no surprise that PGP has flaws... NSA may allegedly have put them there long ago and some of them are just now being found?
False. Open source guarantees nothing. How do you verify the code you're running matches the source code?
Intel's errata are longer than a Tolstoy novel. How do you know the hardware is doing what you told it to, and not more than that?
As a practical matter, very few people are qualified to audit source code, and 99.999% of FSF lamers and fanbois can't write code, much less read it.
I am surprised the EFF would participate in this circle jerk. This has nothing to do with encryption. This is one of the great pieces of yellow journalism of our time, and I'm amazed Slashdot would perpetuate it. Shame on you...
(Sorry... I know you were probably just riffing on the recursive acronym)
AFAIK, Elm doesn't support S/MIME nor GPG/PGP (though you can pipe stuff out to gpg to view the plain text, obviously). I'm not even sure Elm is Y2K compliant (according to http://www.instinct.org/elm/, "Update 06th Jan 2000: elm 2.4 is not Y2K compliant."). There are other, and more modern, terminal based email clients that may be worth mentioning. And there are older mail clients that also don't support S/MIME ("mail" from mailutils).
I have always disabled html in my email program.
I use Thunderbird, html is disabled, remote content is disabled, I have thoroughly gone through it's about:config, I only connect to my ISP with port 995 and 465, and I run Thunderbird in a firejail. I have also deleted many of it's trusted certificate providers.
I use the Enigmail plugin and do not automatically decrypt.
Is there anything else to be done to secure this?
I agree, it would be better. But imagine the tsunami of customer support calls when people complain they can't see their FB notification emails.
The cesspool just got a check and balance.
Read the description of the problem again.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You clearly didn't even read my comment, so I won't bother crafting a response either.
The word "he" is gender neutral.
The word "she" is feminine.
Also, we all know the hacker ain't a woman.
just convince it....
sudo groupadd mailonly
sudo usermod -a -G mailonly `whoami`
sudo ipset create allowed-mailclntdst6 hash:ip family inet6 timeout 0
sudo ipset create allowed-mailclntdst hash:ip family inet timeout 0
sudo ipset add allowed-mailclntdst6 [imap.provider.tld]
sudo ipset add allowed-mailclntdst6 [smtp.provider.tld]
sudo ipset add allowed-mailclntdst [imap.provider.tld]
sudo ipset add allowed-mailclntdst [smtp.provider.tld]
sudo ip6tables -I OUTPUT -m owner --gid-owner mailonly -j REJECT
sudo iptables -I OUTPUT -m owner --gid-owner mailonly -j REJECT --reject-with icmp-port-unreachable
sudo ip6tables -I OUTPUT -p tcp -m multiport --dports 143,465,587,993 -m owner --gid-owner mailonly -m set --match-set allowed-mailclntdst6 dst -j ACCEPT
sudo iptables -I OUTPUT -p tcp -m multiport --dports 143,465,587,993 -m owner --gid-owner mailonly -m set --match-set allowed-mailclntdst dst -j ACCEPT
sg mailonly thunderbird