ADVERTISEMENT
EFAIL is the name of a new set of vulnerabilities that allow attackers to exploit issues in OpenPGP and S/Mime to gain access to encrypted messages.
OpenPGP is an encryption standard that Internet users may use to protect sensitive data such as emails by using encryption. S/Mime is another standard that is widely used in corporate environments.
EFAIL requires that the attacker managed to gain access to encrypted emails and that the target runs client software that is vulnerable to one of the two available attack types.
An attacker could gain access to encrypted emails by monitoring network traffic, compromising email servers or the computers of users, or gaining access to backup servers.
The attack works in the following way:
The attacker may use two different types of attacks. The first is called direct exfiltration by the developers. It works in clients such as Mozilla Thunderbird, Postbox, MailMate, iOS Mail or Apple Mail and enables the attacker to exfiltrate the plaintext message of the encrypted email directly.
This attack works in the following way:
The second attack type works against a larger number of email clients. In fact, the only clients protected against S/Mime attacks are Claws Mail and Mutt whereas more clients are protected against PGP-targeting attacks.
The researchers suggest the following mitigation strategies:
While not explicitly mentioned, you may also disable the loading of remote content in the email client to prevent successful exploits.
Thunderbird users may want to check out our guide Switch Between HTML And Plain Text Emails In Thunderbird to enable plaintext email messages in the client. It is furthermore advised to disable the loading of any remote content by disabling "allow remote content in messages" under Tools > Options > Privacy.
Additional information about the vulnerability is available on the website the researchers created.
Now You: Do you use OpenPGP or S/Mime?
Related articles
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.
This would is messed up beyond repair in my view. Just because you can do something doesn’t mean you should. Every single day there’s a new vulnerability, and/or a hack/breach happened. You can also go knockout that 90 year old grandma, and take her purse, but we don’t (well most of us). This world should be a safe free world. No locks, no worries about security, no wondering what bad thing is around the corner. I’m done with it all. Good bye.
So I read the content on the efail website and further details in the technical paper … and I’m more than a little bit staggered that a vulnerability like this wasn’t found earlier. Or if it was found, then much care must have been taken to avoid making it public.
This is really tricky, because from the way I understand it, you can send someone a HTML mail and hide multiple PGP encrypted code blocks in the HTML code, none of which will be visible to the reader. Because of this, you can use a lot of subterfuge too, like disguising the E-Mail either as spam or by imitating a real service you use.
I think you can add one more item to the list of potential protection methods and that is to use a different E-Mail client. Take The Bat! for example, it comes with its own HTML viewer that already blocks scripts, but for this problem the much more useful feature is that by default it does not load ANY third-party content unless you specifically allow it from either a sender or based on the hostname of the external content (here’s a screenshot of this https://i.imgur.com/pnRFyh3.png ).
While this makes many HTML mails less “nice”, it also stops tracking pixels cold and increases your privacy. Whenever I need to view a more complex HTML mail properly, which doesn’t happen all that often, I double-click on the Message.html “attachment” and open it directly in my browser.
The Bat! also allows the user to disable the reading confirmation replies (the E1 vulnerability in the technical paper), though I don’t think that’s on by default.
EFF :
Disabling PGP in Thunderbird with Enigmail
https://www.eff.org/deeplinks/2018/05/disabling-pgp-thunderbird-enigmail
Disabling PGP in Apple Mail with GPGTools
https://www.eff.org/deeplinks/2018/05/disabling-pgp-apple-mail-gpgtools
Disabling PGP in Outlook with Gpg4win
https://www.eff.org/deeplinks/2018/05/disabling-pgp-outlook-gpg4win
It’s not PGP that should be disabled, it’s HTML interpretation.
No, PGP is not broken, not even with the Efail vulnerabilities
https://protonmail.com/blog/pgp-vulnerability-efail/
EFF, a nonbiased, 3rd party, nonprofit organization with a rich background in all things privacy and security related: “EFF’s current recommendation is to disable PGP integration in email clients”
ProtonMail, a for-profit corporation that uses PGP in their email $ervice: “PGP is fine guys… trust us! So go ahead and keep those unsecure PGP plugins enabled…”
I know who I’ll trust! ;)
The perfect target of a vulnerability such as this one is pretty clear: businesses. What do business most commonly use for internal communication now a days? Email. Email clients to be more specific. Therefore, and assuming a vast majority of business email users (or most of internet users for that matter) are NOT computer literates, it is a very good advise to cease the use of potentially vulnerable email clients in order to preserve security and privacy. Much like when there’s a fire in the 20th floor, but you would evacuate the entire building anyway for safety.
According to the EFF: “Because WE ARE AWAITING the response from the security community of the flaws highlighted in the paper, we recommend that for now you uninstall or disable your PGP email plug-in.”
Which means, they literally have no idea whether this is real or not. Neither do I to be honest. But unlike you, me and the EFF, ProtonMail did work on the PGP standard that they implemented within their own tool. Which is open-source so feel free to go ahead and have a look if you will. Not that any of it really matters since nobody has really confirmed if this is true, which EFF’s statement stands true only because of good practice safety measures.
>> I know who I’ll trust! ;)
This kind of comment? Yeah, makes you sound clever and cool and stuff. No useful at all, though. Please inform yourself before attempting to send any kind of message to the public and spread unnecessary panic and/or misinformation. Especially regarding security. I sure know who I wouldn’t trust in this case ;)
>>Long Term: OpenPGP and S/Mime standards need to be updated.
Email vulnerabilities due to HTML have been known for quite a while, this is another example that is targeted at encrypted emails but it certainly does not mean there’s a vulnerability in PGP. The problem is within the software client which should be updated/patched to address this issue, and use another form of encryption until it’s fixed.
This.
I’m actually amazed that people are thinking this is a problem with PGP. It’s not. It’s a problem with HTML in email, and it’s not the only (or most severe) such problem. If you’re worried about security, you should not be allowing your email client to be interpreting HTML in emails, whether you use PGP or not.
It’s a very serious threat vector.