Slashdot Mirror
Attention PGP Users: New Vulnerabilities Require You To Take Action Now (eff.org)
A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. From a report: EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages. The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific).
In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication. Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email. Further reading: People Are Freaking Out That PGP Is 'Broken' -- But You Shouldn't Be Using It Anyway (Motherboard).
In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication. Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email. Further reading: People Are Freaking Out That PGP Is 'Broken' -- But You Shouldn't Be Using It Anyway (Motherboard).
Isn't this supposed to be a peer reviewed...
Yes... which is how we know about the problem and can address it. Open Source isn't magic.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
In other news, lock picks can be used to open up your model of door lock. We advise you to remove all door locks from your door until a lock pick proof lock can be engineered and installed.
The problem is the clients decrypt, then process any external requests for content. So if you can re-send an encrypted email with an external content request added to it, the client will happily decrypt then send the content request with your precious decrypted content. If you globally disable fetching any external content you don't have to worry. The encryption protocols all work fine, it is the behavior of the clients after the decryption that is the problem. So S/MIME would be affected too, or potentially any other encryption tool. Refusing to load any external content under any circumstances is good advice anyway.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Isn't this supposed to be a peer reviewed protocol that was guaranteed to be secure? How long has this program existed? Holy shit.
The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
PGP is broken now? It's only had fairly infrequent and minor issues over time. If this is broken now, then it's the final sign that anyone who thinks computers can be secured is wrong. If you want something secure, write it down in a notebook. It'll be about 100x more secure than putting it on a computer simply by not being networked. Even if someone steals and reads your notebook it's better than someone having it on their phone (or PGP, now I guess) for the ENTIRE WORLD to come along and steal. Computers are great for games, everything else is debatable.
Yes, indeed, some advice there. Because there is some potential for bad actors to possibly decrypt some of the PGP encrypted messages, if said messages include HTML with links to 3rd party sites (which your email client must display automatically), you need to **completely disable** email encryption. Then all of your email becomes clear text and, fully readable by anyone without effort, and thus you are completely safe from that vulnerability. SMH.
That wonderful advice is brought to you by researchers in no way sponsored by NSA or any other 3 letter agency.
For those worried - make sure your email client does not automatically display any embedded HTML links (or, better yet, just turn off HTML formatted email). I believe this is the default for Enigmail encrypted email anyway. Use plaintext, and you are as safe as cryptography allows. (I believe Enigmail authors posted a message to that effect).
I'm no security expert, but allowing HTML mail to arbitrarily download embedded graphics in a mail client is just dumb. From my reading of the articles, doing that doesn't disable the problem, but keeps the information from escaping back to the malicious parties. This is a mail client problem triggering PGP to decrypt, then allowing the information to escape through embedded graphics, not a fundamental problem in PGP itself. Turning off HTML mail support at the client and just taking the text representation of the message looks like it completely defeats the hack. Tell me if I'm wrong.
From https://lists.gnupg.org/piperm... :
> 1. This paper is misnamed.
Indeed
> 2. This attack targets buggy email clients.
Exactly
> 3. The authors made a list of buggy email clients.
Well said.
The MUA should not allow *any* utilization of HTTP when rendering a HTML E-mail. Any form of doing that is a serious mistake. Not only because of what is reported here, but also because that way *that* use of HTTP will allow spammers to identify when you open the E-mail. They use that to know if your E-mail adress is still alive.
Serious MUAs don't do this without user consent. Most HTML components even have a explicit offline mode exactly for that reason. Meaning that they won't automatically go online and fetch things like the src url of an IMG.
Any MUA that does this without user consent is completely and utterly wrong. Especially in a security sensitive context. This is something most MUA developers know about and if not, should know.
Better mod this up because a lot of people will be getting this wrong.
So, this isn't about my wearing pants?
Have gnu, will travel.
What might be common sense for us is certainly not for newcomers to PGP or those being made to use PGP in a corporate environment as part of a 'best practice'
when you're sending a PGP message, it needs to be plaintext. HTML is simply too dangerous to be disarmed in every conceivable application. This means your email messages should be read in plaintext for PGP.
I also think the EFF is a bit paranoid in issuing a 'full stop' to using PGP until this is fixed. At worst, you should send a link to the PGP document you'd like the user to read (in plaintext of course.)
Good people go to bed earlier.
Sounds like just what the spies would like you to do to gain temporary access to most communications that used to be encrypted, while disabling some of them...
In Soviet Washington the swamp drains you.
Seriously - there’s no good reason for an email which is important enough to encrypt to include html or other “rich formatting” anyway. Just turn it all off.
#DeleteChrome
PGP is broken now? It's only had fairly infrequent and minor issues over time. If this is broken now, then it's the final sign that anyone who thinks computers can be secured is wrong. If you want something secure, write it down in a notebook. It'll be about 100x more secure than putting it on a computer simply by not being networked. Even if someone steals and reads your notebook it's better than someone having it on their phone (or PGP, now I guess) for the ENTIRE WORLD to come along and steal. Computers are great for games, everything else is debatable.
PGP is not broken. The way a few bad email clients are using it is broken. If you are not using Thunderbird you are safe with PGP. While S/MIME is comprised in every email client except modern Outlook, KMail, and mutt.
I also think the EFF is a bit paranoid in issuing a 'full stop' to using PGP until this is fixed. At worst, you should send a link to the PGP document you'd like the user to read (in plaintext of course.)
The EFF said no such thing; they recommended uninstalling or disabling widgets that *automatically* decrypt in the MUA.
>Immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email!
Isn't this supposed to be a peer reviewed protocol that was guaranteed to be secure? How long has this program existed? Holy shit.
The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
And only for HTML emails, and only in Thunderbird, Apple Mail, Postbox and Airmail. So if you are using a better email client especially a non-Mac one you are fine.
My understanding of this is that it applies only to HTML email - if you are using S/MIME and PGP/GnuPG with text-only emails, you should be fine. So why are EFF calling for disabling all PGP and GnuPG?
Finding God in a Dog
This vulnerability affects those who have no idea how to use encrypted emails. HTML is not to be used in encrypted emails, neither is external references. In fact anyone who is versed in the secure use of email has any and all external references disabled. I do not care for your fancy font or for the background wall paper, If you refuse to attach any pertinent images directly to the email then they are not worth my time. Email is meant to be used as a direct method of communication, only the relevant portions need to be included and font and color are not relevant.
Personally i blame Microsoft for trying to get the masses to adopt email, if they had just left well enough alone then we wouldn't have half of the problems we do today.
In other words, disable HTML rendering in your email client, and check for other external referencing stupidity it might have. All of which shouldn't be in your client in the first place. So get a better client.
Which again means that the problem isn't in PGP/GPG, and the "security" "researchers" are much busier drumming up hype than they're doing useful work. Which is par for the course in s'kiddie-land. But we already knew that too, of course.
The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
And only for HTML emails, and only in Thunderbird, Apple Mail, Postbox and Airmail. So if you are using a better email client especially a non-Mac one you are fine.
According to the EFF notice, it also affects Outlook with the GPG4win plugin. Outlook also has builtin S/MIME checking, and oddly, that's been throwing errors on the signed emails I'm getting from the ClamAV list this morning...
If you have nothing to hide... then why are you using PGP? It is only used by criminals and the like.
Ha, ha.
But seriously. If you have nothing to hide, do all your communication with your bank, mortgage holder, broker, 401(k) administrator, and doctor solely by postcard. And take the shades off your windows.
Law-abiding people have PLENTY to hide. And they have a RIGHT to hide it. The Fourth Amendment, among other parts of the constitution, explicitly recognizes this, and the Supreme Court has issued a ruling making explicit and binding an easy-to-understand "Right to Privacy" interpretation of a combination of several pieces of the Constitution.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
This all goes back to really stupid features being added to email. There is no good reason to load external resources into an email. Want to include an image in your email? Go for it, but include it in the email. Why the hell would an external image get automatically loaded in an email that I downloaded for offline reading?!?! If it's external, just provide a link to it. Hell, just get rid of HTML email altogether!
The CBC "gadget" vulnerability seems kinda scary (see https://efail.de/), but I'm fairly certain that a signed and encrypted message would identify these (modifying the encrypted message via CBC gadget will break the message signature). While one *can* send an encrypted message that is not signed, that's never actually done. So, if you get an encrypted message that is not signed, that set off an alarm in the email client and lock down that message (sandbox it).
This is 100% the fault of the email client implementations. FWIW, if you still use mutt or pine or alpine etc, you're safe for now. They did mention other backchannels, but didn't name any... maybe more will be disclosed on that later?
This could be misunderstood -- the whole point of the attack is that the attacker changes a non-HTML email into an HTML one. If your mail client doesn't support HTML (or displays the formatting but doesn't fetch anything) then you're fine.
This isn't correct.
There are two bugs. One is a sort of braindead one which only affects a small number of clients (including Thunderbird and Apple Mail), and has nothing to do with PGP or SMIME.
The other one is more serious, and does have to do with SMIME and PGP. Basically, if an attacker has a copy of an email which is encrypted but not signed, and knows what some of the plaintext is exactly, she can splice out those bits and put in other bits. And basically all e-mails contain things like Content-type: text/plain. So, an attacker can modify that to Content-type: text/html\n\n <img src=.
Regarding this bug, the website says:
I agree that it's a bug for MUAs to automatically download external content in encrypted emails. But it's a much more understandable bug to make.
TCP: Why the Internet is full of SYN.
Nobody said open source is a panacea to make software secure, bit it *is* a prerequisite for a user to verify that a piece of software is secure. It's like politicians that don't reveal their tax returns: those that don't do it aren't necessarily crooked, and those that do aren't necessarily honest. But one of the criteria for being certain that they're honest is to be able to audit those returns.
Either some didn't read the entire article or don't understand the need for authenticated encryption.
The issue the EFF is concerned about is that the OpenPGP spec doesn't mandate authenticated encryption and doesn't specify what to do if authentication fails.
The authentication tag could be as simple as the HMAC of the encrypted message using the symmetric key as the HMAC "secret". Attackers can't create provide a modified message that could be authenticated without knowing the shared key.
Have the minimum AES mode be GCM or other AEAD encryption modes such as ChaCha20-Poly1305.
The standard needs at least two new SHALLs 1) All encryption modes shall be AEAD. 2) Decryption process shall immediately stop if authentication fails and no part of the message is presented to the user.
We fear that the PGP software stores hiddenly the password of the user in the PGP-encrypted message.
I know it is hard to trust anything in a software ecosystem where the likes of RSA Security has been implicated in a security weakening scandal, and one could almost certainly hide data within an Open-PGP message (e.g. adding a private/experimental packet), but I also know that software I use does not do this. I say this because I have done the exercise of analyzing and decrypting Open-PGP messages produced by GnuPG, and I can account for every byte of each packet with the encrypted massages I have analyzed.
But don't trust me: Look up the RFC 4880 and check for yourself. You'll need to do some work because the protocol is klunky, but it is worth doing if you are seriously concerned.
https://lists.gnupg.org/piperm...
3 strawmen in one post? Wow we got a record boys.
This is 100% the fault of the email client implementations.
No, it isn't. Its yet another open source failure. Many eyes.. haha
It absolutely IS the fault of email clients. PGP/GPG doesn't go out and load remote content.
The cesspool just got a check and balance.
Apple Mail is fine, and I'm sure others are too, if you turn off "Load remote content". I did that a while ago because it's one of the ways FB and Google both track you.
The cesspool just got a check and balance.
PGP is broken now? It's only had fairly infrequent and minor issues over time. If this is broken now, then it's the final sign that anyone who thinks computers can be secured is wrong. If you want something secure, write it down in a notebook. It'll be about 100x more secure than putting it on a computer simply by not being networked. Even if someone steals and reads your notebook it's better than someone having it on their phone (or PGP, now I guess) for the ENTIRE WORLD to come along and steal. Computers are great for games, everything else is debatable.
PGP is not broken. The way a few bad email clients are using it is broken. If you are not using Thunderbird you are safe with PGP. While S/MIME is comprised in every email client except modern Outlook, KMail, and mutt.
If you are using Thunderbird and you have disabled loading remote content in messages (which you should be doing anyway) then this issue (which relies on automatic execution of embedded remote URLs) won't affect you. HTML emails are the real problem here.
And really has not much to do with PGP/GnuPG either, it is about the insane HTML integration in email software that can leak data if external resources are loaded automatically and, apparently, your email is decrypted automatically. If you have either of these, your security has gone out of the window long before the present issue was discovered. Also seems to require a broken MIME parser. Hence this is an issue with mailers, not with PGP/GnuPG (or rather the OpenPGP format). Pretty much the same screw-up by email software makers also affects S/MIME, only it suffers from missing authenticated encryption in addition.
Bottom line, a sane set-up that only renders HTML (or refuses it completely like I used to, these days I convert it to text with lynx), but does not fetch/execute anything should be safe from this. And yes, you should definitely use PGP/GnuPG, despite what some people say.
The other bottom line is that many people making email software have really, really screwed up here. The makers of PGP/GnuPG have not.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
PGP is very much _not_ broken. Some wannabee mail software is badly broken in how it handles HTML, MIME and PGP integration. This is also not a surprise at all. There is a reason many of us still use mutt or elm or the like at least for encrypted email.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Nothing is "guaranteed to be secure". Incidentally, it is not PGP or GnuPG that is at fault here. It is fundamentally broken and insecure HTML and MIME parsing in the email software affected. PGP/GnuPG is perfectly fine.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This is 100% the fault of the email client implementations. FWIW, if you still use mutt or pine or alpine etc, you're safe for now.
Oh, yes. Mutt user here (at least for encrypted email), because I have never trusted these messed up insecure jokes that pass for email software these days. Automatically loading stuff from external places in this way is an instant security fail. Nobody with a clue is surprised this can be exploited.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
PGP/GnuPG also does no MIME parsing, which must be broken as well to allow the attack. This is 100% incompetent implementation of email software by people that are clueless about security.
I also have to say I find all the alarmists here a disgrace. Clueless, arrogant and panicky, a very bad combination.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Apple Mail is fine, and I'm sure others are too, if you turn off "Load remote content". I did that a while ago because it's one of the ways FB and Google both track you.
True, but it really should be default off, and be warned against turning on.
Why does this post make me sure you're the one who wrote it?
A lot of security flaws arise from someone wanting to improve the "user experience". We've known almost forever that convenience the enemy of security.
> The problem is in how email program plugins handle the mail after it's been decrypted, not in the underlying PGP/SMIME code.
Apparently thats wrong; it seems that core vulnerabilities lie inside the use of the gpg and smime protocol implementations themselves.
In particular, the lack of a valid message digest, and the default behavior of returning decryption results (or even attempting decryption) when the digest is invalid is the core problem.
If tampered encrypted payloads are detected, *decryption must not be attempted*
It seems over gnupg is vulnerable to this attack.
> is not PGP or GnuPG that is at fault here
They are at fault for violating the "enc then mac" principle.
They should not return decrypted content of tampered messages, and if they didnt the gadget weakness would not exist.
This is absolutely a crypto issue in addition to an email client issue.
(Sorry... I know you were probably just riffing on the recursive acronym)
AFAIK, Elm doesn't support S/MIME nor GPG/PGP (though you can pipe stuff out to gpg to view the plain text, obviously). I'm not even sure Elm is Y2K compliant (according to http://www.instinct.org/elm/, "Update 06th Jan 2000: elm 2.4 is not Y2K compliant."). There are other, and more modern, terminal based email clients that may be worth mentioning. And there are older mail clients that also don't support S/MIME ("mail" from mailutils).
I agree, it would be better. But imagine the tsunami of customer support calls when people complain they can't see their FB notification emails.
The cesspool just got a check and balance.
Read the description of the problem again.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You clearly didn't even read my comment, so I won't bother crafting a response either.