New encryption vulnerability means email is no longer secure

Steve Phelps
May 15, 2018

The researchers said on a website devoted to this vulnerability that "EFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs".

Researchers at FH Munster University of Applied Sciences have released details of a vulnerability with no known patch which could allow hackers to turn a ciphered message into plain text and read it.

Ultimately, if you don't use PGP or S/MIME for email encryption, then there's nothing to worry about. Werner Koch, a core components maintainer for GnuPG - a complete and free implementation of the OpenPGP standard - says he's seen a copy of the researchers' paper, with the names of all but one vulnerable mail user agent (MUA) redacted, notes that the flaws involve some HTML email clients' implementation of PGP.

Whistle-blowers, political activists and others who depend on encrypted email could all be compromised by the bug, the researchers said in a blog post. By also including the Web address of an attacker-controlled server, the newly sent emails can cause the programs to send the corresponding plaintext to the server.

The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. "This creates a single encrypted body part that exfiltrates its own plaintext when the user opens the attacker email".

While the attack is "sneaky", independent security advisor Graham Cluley is one of several experts who have said the significance and severity of the Efail attacks have been overstated.

Predicted line-up for final Premier League game of the season
Mohamed Salah has declared that he is staying with Liverpool next season after enjoying a record-breaking debut season at Anfield. One would struggle to think of a more impactful debut season than that which Mohamed Salah is now enjoying at Liverpool .

In a tweet, the Foundation especially warned users not to decrypt PGP-encrypted messages in mail clients. To successfully carry out an attack, the hacker must first have the encrypted email in possession, whether it's through eavesdropping, hacking into an email server, and so on. The flaw, named EFAIL, reportedly affects both sent and received messages, including past correspondence. But the researchers cautioned that since attacks could become increasingly sophisticated in future, strategies which bolster OpenPGP and S/Mime standards are required for a long term fix. As a more extreme measure, you could remove the PGP keys from the mail client entirely, preventing the app from any decrypting encoded strings.

Efail is not a good reason for users of PGP/GPG to disable it entirely, according to Cluley.

"In response to that, they said that they did a simple rollback to the non-MDC encryption", he said.

The best way to keep yourself, and your email safe is to make sure your email client and system as a whole is updated.

The response: Some security executives say the risk exists only in email programs that don't check for decryption errors, so it's worth verifying whether yours does.

The security community, however, has claimed these measures aren't necessary.

Other reports by

Discuss This Article

FOLLOW OUR NEWSPAPER