Attention PGP Users: New Vulnerabilities Require You To Take Action Now

[tao]

A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.

 

The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific). In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication.

 

Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.

 

Please refer to these guides on how to temporarily disable PGP plug-ins in:

Thunderbird with Enigmail

Apple Mail with GPGTools

Outlook with Gpg4win

These steps are intended as a temporary, conservative stopgap until the immediate risk of the exploit has passed and been mitigated against by the wider community.

We will release more detailed explanation and analysis when more information is publicly available.

 

< Here >

[tao]

Also:  Researchers have found a vulnerability in two popular email encryption protocols

 

European security researchers have found an alarming new vulnerability in the most common forms of email encryption. The attack, described in a report published Monday morning, lets bad actors inject malicious code into intercepted emails, despite encryption protocols designed to protect against code injection. Implemented correctly, the malicious code could be used to steal the entire contents of a target’s inbox.

 

The vulnerability affects two of the most common email encryption protocols, PGP and S/MIME, although the degree of vulnerability depends heavily on the client’s implementation of the protocol. A number of different clients are vulnerable, including Apple Mail, the Mail App on iOS, and Thunderbird. Notably, many currently available message authentication systems can effectively block the attack.

 

If an email encrypted using those clients is intercepted in transit, an attacker could use the new vulnerability modify the email, adding malicious HTML code before sending it to the target. When the target opens the new email, the malicious code could be used to send back the plaintext of the email.

 

Many corporate servers still use S/MIME encryption, so the attack poses a significant risk to current systems.

 

< Here >

 

 

[capt_blake]

"No, PGP is not broken, not even with the Efail vulnerabilities"
Technical Analysis of the eFail Vulnerability:
https://protonmail.com/blog/pgp-vulnerability-efail/