Elvis Wiki - User contributions [en]

WiFi Pineapple Mark VII: Evil Twin Attack using Captive Portal

2022-01-31T15:27:34Z

KBeboso:

== Summary ==

EvilPortal is a captive portal tool for the Wi-Fi Pineapple. It allows users to easily setup landing pages that are automatically displayed to clients who connect. In this guide, we will be using the Pineapple Mark VII to set up the Evil Portal module. This module is used for capturing victim devices, by using a rouge access point and fake login page:

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site.

To complete these steps, you must have followed [[Wi-Fi Pineapple Mark VII: Initial Setup]] before.

=== Mandatory ===
==== GNU/Linux ====

* This project requires you to install Evil Portal captive portal module created by frozenjava. To install on the Pineapple, go to Modules → Manage Modules → Get Modules from Hak5 Community Repositories → Evil Portal 3.2.

* Evil Portals <ref>https://github.com/kleo/evilportals</ref> is a collection of portals that can be loaded into the Evil Portal module. It can be used for phishing attacks against Wi-Fi clients to obtain credentials or infect the victims with malware using the Hak5 Wi-Fi Pineapple Mark VII.

== Features ==

* Targeted Portals
* Static Portals
* Creating/Editing/Activating/Deleting Portals
* White listings clients by ip address
* Dynamically adding and revoking authorized clients
* Live Preview of your portal through the module interface

== Description ==

=== Step 1 (Download Module) ===

* First, we will open a browser. In the URL box, we will type 172.16.42.1:1471 to access the login interface for the Pineapple:
* After Login, we will be brought to the dashboard interface page. Select the Modules tab from the menu on the left side of the screen.
* Then click on Manage Modules.
* Next, click on Get Modules at the top of the screen. The following screenshot displays the screen you should be seeing in this step:
* Select the Evil Portal module.
* After you click on Evil Portal under the Modules tab (left side of screen), you will see the interface page for the module. (The following screenshot displays the interface page for the Evil Portal module):

=== Step 2 (Create & Activate Portal)===

* Download Evil Portals and upload it on to the Pineapple Mark VII Device via SFTP <code>sftp://root@172.16.42.1</code>

* Now choose a given template, and we will start the portal by clicking Activate, located to the right of Portal Name. After you have clicked Activate, you will click Start in the Controls tab located toward the top left of the screen (the screenshot from Step 3 also displays where the start button is located).

* Next, we will click on the Live Preview tab, located towards the bottom of the screen. We see the default Evil Portal page, which is the page our simulated victim will log in to when connecting through our rouge access point. Furthermore, the Evil Portal page can be customized to anything you want. For this lab, we will use the default page. We advise caution when cloning other landing pages to use as the Evil Portal page. The following screenshot displays what the Evil Portal default page looks like:

* The final step is to see what a simulated victim looks like when they connect to the Evil Portal page. The victim device connects to the rogue access point the Pineapple is broadcasting. Once the victim connects, they will be presented with the Evil Portal default page, simulating a Wi-Fi landing page. The victim will click Authorize by entering E-Mail and Password and then will show up under the Authorized Clients tab, displaying the victim's IP. At this point, other modules can be used to launch a MITM attack by using modules like SSLsplit. In the Portal next to the template, you can retrieve email and password by opening the log file.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

[[Category:Documentation]]

2022-01-23T18:47:17Z

KBeboso: KBeboso moved page WiFI Pineapple Mark VII: Cracking Wifi Password to WiFI Pineapple Mark VII: Cracking Wi-Fi Password

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

== Mandatory ==
=== GNU/Linux ===

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==

=== Step 1 ===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 2 ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 ===
In this method we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default wifi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research you figured out that the default wifi password is an 8 digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now the cracking process may take a while depending on your processor speed but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2022-01-23T18:44:32Z

2021-12-05T22:56:07Z

KBeboso:

E-Fail

2021-12-05T22:55:31Z

KBeboso:

== Summary ==

The E-FAIL attack takes use of flaws in the OpenPGP and S/MIME protocols to
reveal the plaintext of encrypted emails. In short, EFAIL abuses the active content in
HTML emails, such as externally loaded images or styles, and leaks plaintext via the
requested URL. To create these exfiltration channels, the attacker must first access encrypted
emails by, for example, eavesdropping on network traffic, destroying email accounts,
email servers, backup systems or client computers. These emails may even have been
collected many years ago. The attacker modifies the encrypted email in some way and
sends the modified encrypted email to the victim. The victim’s email client decrypts
the email and loads all external content to reveal the plaintext to the attacker.

== Direct Exfiltration Channels in Email Clients ==
Direct Exfiltration attacks exploit vulnerabilities in Apple Mail, iOS Mail, and Mozilla
Thunderbird to directly leak the plaintext of encrypted emails. These vulnerabilities
can be fixed in the corresponding email client. The attacker creates a new multipart
email with three paragraphs of text, as shown below 3.3 . The first is a piece of HTML
text that is essentially an HTML image tag. Note that the src attribute of this image
tag is opened with quotes, not closed. The second body contains PGP or S/MIME
ciphertext. The third is also an HTML body part that disables the src attribute of the
first body part
[[File:exfil1.png|200px|thumb|middle|Example of an E-Mail]]
[[File:exfil2.png|200px|thumb|middle|Example of an E-Mail]]

This email is then sent to the victim by the assailant. The client of the victim
decrypts the second encrypted body part and inserts the three body parts into the
HTML email as illustrated below. 3.4. Note that the src attribute of the image tag in
line 1 is disabled in line 4, so the URL includes all four lines.

[[File:exfil3.png|200px|thumb|middle|HTML-Email]]

Then, the email client URL encodes all non-printable characters (e.g. ”20” is a
space) and requests the image from that URL. Because the plaintext of the encrypted
email is contained in the URL route, the victim’s email client delivers the plaintext to
the attacker. Direct exfiltration EFAIL attacks are applicable to PGP and S/MIME
encrypted emails.

Figure 3.5: Vulnerable email programs to the knowledge of the security researchers
who discovered the Efail vulnerability.
[PDM+18]

== The CBC/CFB-Gadget-Attack ==

First, we’ll go through the new CBC/CFB gadget attacks, which take use of flaws
in the OpenPGP and S/MIME specifications to steal plaintext.The concept of CBC
gadget in S/MIME is depicted in the diagram below. An attacker can precisely edit
plaintext blocks if they know the plaintext due to the characteristics of the CBC
mode of operation. As seen in 3.1 (a), S/MIME-encrypted emails frequently begin
with ”Content type: multipart/signed,” indicating that the attacker has at least one
complete plaintext block. It can then create a canonical plaintext block with zeros as
its content, as seen in 3.1 (b). The block pair X and C 0a is referred to as a CBC
device. It then appends CBC gadgets to the encrypted plaintext to insert an image
tag in step 3.1 (c). When the user opens the attacker email, this creates a single piece
of encrypted text that exfiltrates its own plaintext. OpenPGP employs the CFB mode
of operation, which has cryptographic features that are extremely similar to CBC and
allows the same attack to be carried out with CFB gadgets.
The distinction is that any standard-conforming client will be vulnerable, and each
vendor will be free to devise their own mitigations, which may or may not prevent the
attacks. As a result, it will be important to update the specification in the long run
in order to uncover and record changes that address the underlying primary causes of
the vulnerabilities.
[[File:Example.jpg]]

Despite the fact that the CBC/CFB gadget attacks on PGP and S/MIME are
theoretically similar, the conditions for a successful attack differ significantly. Attacking
S/MIME is simple, because by sending a single designed S/MIME email to the target,
an attacker can break several (in our experiments, up to 500) S/MIME encrypted
emails. Modern OpenPGP implementations, unlike S/MIME, include a Modification
Detection Code (MDC) that may identify modified plaintexts and so prevent the CFB
gadget attack. However, we discovered that several clients only displayed the updated
plaintext after issuing a warning to the user for invalid MDCs.

Despite the MDC, the CFB gadget attack was possible. PGP also compresses the
plaintext before encrypting it, making guessing known plaintext bytes more difficult.
Based on our current findings, the CFB device attack against PGP has a success rate
of about one out of every three attempts. Plaintext compression, we believe, is more of
a technical snag than a fundamental restriction of the EFAIL attacks, and that further
research will make the attacks more efficient.

== Mitigations==
To continue using email encryption securely, users must implement the following points
To prevent EFAIL attacks. This section is divided in to three terms to visualize the
urgency of each implementation.

=== Short-Term ===
Active content in the email client must be disabled. This includes HTML code execu-
tion and the reloading of external material, which is frequently authorized for aesthetic
reasons. E-mail servers and e-mail clients must be secured against unauthorized access
attempts.Moreover, in the case of OpenPGP, you can decrypt the e-mails in an external
program instead of in the mail client, so that an attack comes to nothing.
Short term: No decryption in email client. Decrypting S/MIME or PGP emails in a
separate program outside of your email client is the easiest strategy to avoid EFAIL
attacks. Decrypt incoming encrypted emails by copy and pasting the ciphertext into
a different program that handles the decryption for you after deleting your S/MIME
and PGP private keys from your email client. In this manner, email clients are unable
to initiate exfiltration channels. This is currently the safest option with the downside
that the process gets more involved.
Short term: Disable HTML rendering. The EFAIL attacks target active content, which
is often in the form of HTML pictures, styles, and other elements. The most common
approach of fighting EFAIL is to disable the rendering of incoming HTML emails in
your email client. It’s worth noting that email clients have other possible backchannels
that aren’t linked to HTML, but they’re more difficult to attack.
=== Mid-Term ===
Mid term: Update E-Mail client. Vendors of the email clients will publish patches that
either fix the E-Fail vulnerabilities or make them much harder to exploit.
=== Long-Term ===
Long term: Update OpenPGP and S/MIME standards. The EFAIL attacks exploit
flaws and undefined behavior in the MIME, S/MIME, and OpenPGP standards.As a
result, standards must be changed, which will take time. Update: Our advice to dep-
recate the SE packet type and not show updated ciphertexts is reflected in the current
draft of OpenPGP RFC4880.[CalAD]
The CFB gadget attacks can also be prevented by updates, the programs just have to
evaluate the MDC correctly (which GnuPG does by now, an error in the MDC check
now leads to termination) and reject the outdated SE packets so that the attacks are
no longer possible.
The CBC gadget attacks cannot be properly prevented until an updated S/MIME
standard is released. Until that time comes, individual developers will have to develop
their own solutions
11

== Conclusion ==

== References ==

CalAD] J. Callas. Rfc4880, Nov 200AD. URL: https://datatracker.ietf.org/
doc/html/rfc4880. 11
[Cor19] MITRE Corporation, 2019. URL: https://cve.mitre.org/cgi-bin/
cvename.cgi?name=CVE-2019-13050. 7
[Gar96] Simson Garfinkel. PGP: Pretty good privacy. O’Reilly, Internat. Thomson-
Verl, 1996. 5
[MKP+17] Juan Ram ́on Ponce Mauri ́es, Kat Krol, Simon Parkin, Ruba Abu-Salma,
and M. Angela Sasse. Dead on arrival: Recovering from fatal flaws in
email encryption tools. In The LASER Workshop: Learning from Author-
itative Security Experiment Results (LASER 2017), pages 49–57. USENIX
Association, October 2017. URL: https://www.usenix.org/conference/
laser2017/presentation/mauries. 12
[OAS21] OASIS. How email really works, 2021. [Online; accessed December
05, 2021]. URL: https://www.oasis-open.org/khelp/kmlm/user_help/
html/images/howemailworks.png. 4
[PDM+18] Damian Poddebniak, Christian Dresen, Jens Mueller, Fabian Ising, Sebas-
tian Schinzel, Simon Friedberger, Juraj Somorovsky, and Joerg Schwenk.
Efail: Breaking S/MIME and OpenPGP email encryption using exfil-
tration channels. In 27th USENIX Security Symposium (USENIX Secu-
rity 18), pages 549–566, Baltimore, MD, August 2018. USENIX Associ-
ation. URL: https://www.usenix.org/conference/usenixsecurity18/
presentation/poddebniak. 9
[Pos] J Postel. Simple mail transfer protocol. URL: https://tools.ietf.org/
html/rfc821/. 3
[Pur21] PurpleSec. 2021 ransomware statistics, Aug 2021. URL: https://
purplesec.us/resources/cyber-security-statistics/ransomware/.
6
[Ram99] B. Ramsdell. Rfc2633, Jun 1999. URL: https://datatracker.ietf.org/
doc/html/rfc2633. 4
[Rhe13] Man Rhee. Electronic Mail Security: PGP, S/MIME, pages 353–385.
Wikey, 03 2013. doi:10.1002/9781118512920.ch10. 1
14
Bibliography
[Spi16] Dag Spicer. Raymond tomlinson: Email pioneer, part 1. IEEE Annals of
the History of Computing, 38:72–79, 04 2016. doi:10.1109/MAHC.2016.25.
1
[TR10] S Turner and B Ramsdell. Rfc5751, Jan 2010. URL: https://
datatracker.ietf.org/doc/html/rfc5751. 4
[Uni21a] University of Applied Sciences M ̈unster. Cbc gadgets in s/mime, 2021.
[Online; accessed December 05, 2021]. URL: https://efail.de/media/
img/smime-attack.png. 8
[Uni21b] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil1.png. 8
[Uni21c] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil2.png. 9
[Uni21d] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil3.png. 9
[[Category:Documentation]]

E-Fail

2021-12-05T22:55:16Z

KBeboso:

== Summary ==

The E-FAIL attack takes use of flaws in the OpenPGP and S/MIME protocols to
reveal the plaintext of encrypted emails. In short, EFAIL abuses the active content in
HTML emails, such as externally loaded images or styles, and leaks plaintext via the
requested URL. To create these exfiltration channels, the attacker must first access encrypted
emails by, for example, eavesdropping on network traffic, destroying email accounts,
email servers, backup systems or client computers. These emails may even have been
collected many years ago. The attacker modifies the encrypted email in some way and
sends the modified encrypted email to the victim. The victim’s email client decrypts
the email and loads all external content to reveal the plaintext to the attacker.

== Direct Exfiltration Channels in Email Clients ==
Direct Exfiltration attacks exploit vulnerabilities in Apple Mail, iOS Mail, and Mozilla
Thunderbird to directly leak the plaintext of encrypted emails. These vulnerabilities
can be fixed in the corresponding email client. The attacker creates a new multipart
email with three paragraphs of text, as shown below 3.3 . The first is a piece of HTML
text that is essentially an HTML image tag. Note that the src attribute of this image
tag is opened with quotes, not closed. The second body contains PGP or S/MIME
ciphertext. The third is also an HTML body part that disables the src attribute of the
first body part
[[File:exfil1.png|200px|thumb|middle|Example of an E-Mail]]
[[File:exfil2.png|200px|thumb|middle|Example of an E-Mail]]

This email is then sent to the victim by the assailant. The client of the victim
decrypts the second encrypted body part and inserts the three body parts into the
HTML email as illustrated below. 3.4. Note that the src attribute of the image tag in
line 1 is disabled in line 4, so the URL includes all four lines.

[[File:exfil3.png|200px|thumb|left|HTML-Email]]

Then, the email client URL encodes all non-printable characters (e.g. ”20” is a
space) and requests the image from that URL. Because the plaintext of the encrypted
email is contained in the URL route, the victim’s email client delivers the plaintext to
the attacker. Direct exfiltration EFAIL attacks are applicable to PGP and S/MIME
encrypted emails.

Figure 3.5: Vulnerable email programs to the knowledge of the security researchers
who discovered the Efail vulnerability.
[PDM+18]

== The CBC/CFB-Gadget-Attack ==

First, we’ll go through the new CBC/CFB gadget attacks, which take use of flaws
in the OpenPGP and S/MIME specifications to steal plaintext.The concept of CBC
gadget in S/MIME is depicted in the diagram below. An attacker can precisely edit
plaintext blocks if they know the plaintext due to the characteristics of the CBC
mode of operation. As seen in 3.1 (a), S/MIME-encrypted emails frequently begin
with ”Content type: multipart/signed,” indicating that the attacker has at least one
complete plaintext block. It can then create a canonical plaintext block with zeros as
its content, as seen in 3.1 (b). The block pair X and C 0a is referred to as a CBC
device. It then appends CBC gadgets to the encrypted plaintext to insert an image
tag in step 3.1 (c). When the user opens the attacker email, this creates a single piece
of encrypted text that exfiltrates its own plaintext. OpenPGP employs the CFB mode
of operation, which has cryptographic features that are extremely similar to CBC and
allows the same attack to be carried out with CFB gadgets.
The distinction is that any standard-conforming client will be vulnerable, and each
vendor will be free to devise their own mitigations, which may or may not prevent the
attacks. As a result, it will be important to update the specification in the long run
in order to uncover and record changes that address the underlying primary causes of
the vulnerabilities.
[[File:Example.jpg]]

Despite the fact that the CBC/CFB gadget attacks on PGP and S/MIME are
theoretically similar, the conditions for a successful attack differ significantly. Attacking
S/MIME is simple, because by sending a single designed S/MIME email to the target,
an attacker can break several (in our experiments, up to 500) S/MIME encrypted
emails. Modern OpenPGP implementations, unlike S/MIME, include a Modification
Detection Code (MDC) that may identify modified plaintexts and so prevent the CFB
gadget attack. However, we discovered that several clients only displayed the updated
plaintext after issuing a warning to the user for invalid MDCs.

Despite the MDC, the CFB gadget attack was possible. PGP also compresses the
plaintext before encrypting it, making guessing known plaintext bytes more difficult.
Based on our current findings, the CFB device attack against PGP has a success rate
of about one out of every three attempts. Plaintext compression, we believe, is more of
a technical snag than a fundamental restriction of the EFAIL attacks, and that further
research will make the attacks more efficient.

== Mitigations==
To continue using email encryption securely, users must implement the following points
To prevent EFAIL attacks. This section is divided in to three terms to visualize the
urgency of each implementation.

=== Short-Term ===
Active content in the email client must be disabled. This includes HTML code execu-
tion and the reloading of external material, which is frequently authorized for aesthetic
reasons. E-mail servers and e-mail clients must be secured against unauthorized access
attempts.Moreover, in the case of OpenPGP, you can decrypt the e-mails in an external
program instead of in the mail client, so that an attack comes to nothing.
Short term: No decryption in email client. Decrypting S/MIME or PGP emails in a
separate program outside of your email client is the easiest strategy to avoid EFAIL
attacks. Decrypt incoming encrypted emails by copy and pasting the ciphertext into
a different program that handles the decryption for you after deleting your S/MIME
and PGP private keys from your email client. In this manner, email clients are unable
to initiate exfiltration channels. This is currently the safest option with the downside
that the process gets more involved.
Short term: Disable HTML rendering. The EFAIL attacks target active content, which
is often in the form of HTML pictures, styles, and other elements. The most common
approach of fighting EFAIL is to disable the rendering of incoming HTML emails in
your email client. It’s worth noting that email clients have other possible backchannels
that aren’t linked to HTML, but they’re more difficult to attack.
=== Mid-Term ===
Mid term: Update E-Mail client. Vendors of the email clients will publish patches that
either fix the E-Fail vulnerabilities or make them much harder to exploit.
=== Long-Term ===
Long term: Update OpenPGP and S/MIME standards. The EFAIL attacks exploit
flaws and undefined behavior in the MIME, S/MIME, and OpenPGP standards.As a
result, standards must be changed, which will take time. Update: Our advice to dep-
recate the SE packet type and not show updated ciphertexts is reflected in the current
draft of OpenPGP RFC4880.[CalAD]
The CFB gadget attacks can also be prevented by updates, the programs just have to
evaluate the MDC correctly (which GnuPG does by now, an error in the MDC check
now leads to termination) and reject the outdated SE packets so that the attacks are
no longer possible.
The CBC gadget attacks cannot be properly prevented until an updated S/MIME
standard is released. Until that time comes, individual developers will have to develop
their own solutions
11

== Conclusion ==

== References ==

CalAD] J. Callas. Rfc4880, Nov 200AD. URL: https://datatracker.ietf.org/
doc/html/rfc4880. 11
[Cor19] MITRE Corporation, 2019. URL: https://cve.mitre.org/cgi-bin/
cvename.cgi?name=CVE-2019-13050. 7
[Gar96] Simson Garfinkel. PGP: Pretty good privacy. O’Reilly, Internat. Thomson-
Verl, 1996. 5
[MKP+17] Juan Ram ́on Ponce Mauri ́es, Kat Krol, Simon Parkin, Ruba Abu-Salma,
and M. Angela Sasse. Dead on arrival: Recovering from fatal flaws in
email encryption tools. In The LASER Workshop: Learning from Author-
itative Security Experiment Results (LASER 2017), pages 49–57. USENIX
Association, October 2017. URL: https://www.usenix.org/conference/
laser2017/presentation/mauries. 12
[OAS21] OASIS. How email really works, 2021. [Online; accessed December
05, 2021]. URL: https://www.oasis-open.org/khelp/kmlm/user_help/
html/images/howemailworks.png. 4
[PDM+18] Damian Poddebniak, Christian Dresen, Jens Mueller, Fabian Ising, Sebas-
tian Schinzel, Simon Friedberger, Juraj Somorovsky, and Joerg Schwenk.
Efail: Breaking S/MIME and OpenPGP email encryption using exfil-
tration channels. In 27th USENIX Security Symposium (USENIX Secu-
rity 18), pages 549–566, Baltimore, MD, August 2018. USENIX Associ-
ation. URL: https://www.usenix.org/conference/usenixsecurity18/
presentation/poddebniak. 9
[Pos] J Postel. Simple mail transfer protocol. URL: https://tools.ietf.org/
html/rfc821/. 3
[Pur21] PurpleSec. 2021 ransomware statistics, Aug 2021. URL: https://
purplesec.us/resources/cyber-security-statistics/ransomware/.
6
[Ram99] B. Ramsdell. Rfc2633, Jun 1999. URL: https://datatracker.ietf.org/
doc/html/rfc2633. 4
[Rhe13] Man Rhee. Electronic Mail Security: PGP, S/MIME, pages 353–385.
Wikey, 03 2013. doi:10.1002/9781118512920.ch10. 1
14
Bibliography
[Spi16] Dag Spicer. Raymond tomlinson: Email pioneer, part 1. IEEE Annals of
the History of Computing, 38:72–79, 04 2016. doi:10.1109/MAHC.2016.25.
1
[TR10] S Turner and B Ramsdell. Rfc5751, Jan 2010. URL: https://
datatracker.ietf.org/doc/html/rfc5751. 4
[Uni21a] University of Applied Sciences M ̈unster. Cbc gadgets in s/mime, 2021.
[Online; accessed December 05, 2021]. URL: https://efail.de/media/
img/smime-attack.png. 8
[Uni21b] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil1.png. 8
[Uni21c] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil2.png. 9
[Uni21d] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil3.png. 9
[[Category:Documentation]]

E-Fail

2021-12-05T22:54:45Z

KBeboso:

== Summary ==

The E-FAIL attack takes use of flaws in the OpenPGP and S/MIME protocols to
reveal the plaintext of encrypted emails. In short, EFAIL abuses the active content in
HTML emails, such as externally loaded images or styles, and leaks plaintext via the
requested URL. To create these exfiltration channels, the attacker must first access encrypted
emails by, for example, eavesdropping on network traffic, destroying email accounts,
email servers, backup systems or client computers. These emails may even have been
collected many years ago. The attacker modifies the encrypted email in some way and
sends the modified encrypted email to the victim. The victim’s email client decrypts
the email and loads all external content to reveal the plaintext to the attacker.

== Direct Exfiltration Channels in Email Clients ==
Direct Exfiltration attacks exploit vulnerabilities in Apple Mail, iOS Mail, and Mozilla
Thunderbird to directly leak the plaintext of encrypted emails. These vulnerabilities
can be fixed in the corresponding email client. The attacker creates a new multipart
email with three paragraphs of text, as shown below 3.3 . The first is a piece of HTML
text that is essentially an HTML image tag. Note that the src attribute of this image
tag is opened with quotes, not closed. The second body contains PGP or S/MIME
ciphertext. The third is also an HTML body part that disables the src attribute of the
first body part
[[File:exfil1.png|200px|thumb|left|Example of an E-Mail]]
[[File:exfil2.png|200px|thumb|left|Example of an E-Mail]]

This email is then sent to the victim by the assailant. The client of the victim
decrypts the second encrypted body part and inserts the three body parts into the
HTML email as illustrated below. 3.4. Note that the src attribute of the image tag in
line 1 is disabled in line 4, so the URL includes all four lines.

[[File:exfil3.png|200px|thumb|left|HTML-Email]]

Then, the email client URL encodes all non-printable characters (e.g. ”20” is a
space) and requests the image from that URL. Because the plaintext of the encrypted
email is contained in the URL route, the victim’s email client delivers the plaintext to
the attacker. Direct exfiltration EFAIL attacks are applicable to PGP and S/MIME
encrypted emails.

Figure 3.5: Vulnerable email programs to the knowledge of the security researchers
who discovered the Efail vulnerability.
[PDM+18]

== The CBC/CFB-Gadget-Attack ==

First, we’ll go through the new CBC/CFB gadget attacks, which take use of flaws
in the OpenPGP and S/MIME specifications to steal plaintext.The concept of CBC
gadget in S/MIME is depicted in the diagram below. An attacker can precisely edit
plaintext blocks if they know the plaintext due to the characteristics of the CBC
mode of operation. As seen in 3.1 (a), S/MIME-encrypted emails frequently begin
with ”Content type: multipart/signed,” indicating that the attacker has at least one
complete plaintext block. It can then create a canonical plaintext block with zeros as
its content, as seen in 3.1 (b). The block pair X and C 0a is referred to as a CBC
device. It then appends CBC gadgets to the encrypted plaintext to insert an image
tag in step 3.1 (c). When the user opens the attacker email, this creates a single piece
of encrypted text that exfiltrates its own plaintext. OpenPGP employs the CFB mode
of operation, which has cryptographic features that are extremely similar to CBC and
allows the same attack to be carried out with CFB gadgets.
The distinction is that any standard-conforming client will be vulnerable, and each
vendor will be free to devise their own mitigations, which may or may not prevent the
attacks. As a result, it will be important to update the specification in the long run
in order to uncover and record changes that address the underlying primary causes of
the vulnerabilities.
[[File:Example.jpg]]

Despite the fact that the CBC/CFB gadget attacks on PGP and S/MIME are
theoretically similar, the conditions for a successful attack differ significantly. Attacking
S/MIME is simple, because by sending a single designed S/MIME email to the target,
an attacker can break several (in our experiments, up to 500) S/MIME encrypted
emails. Modern OpenPGP implementations, unlike S/MIME, include a Modification
Detection Code (MDC) that may identify modified plaintexts and so prevent the CFB
gadget attack. However, we discovered that several clients only displayed the updated
plaintext after issuing a warning to the user for invalid MDCs.

Despite the MDC, the CFB gadget attack was possible. PGP also compresses the
plaintext before encrypting it, making guessing known plaintext bytes more difficult.
Based on our current findings, the CFB device attack against PGP has a success rate
of about one out of every three attempts. Plaintext compression, we believe, is more of
a technical snag than a fundamental restriction of the EFAIL attacks, and that further
research will make the attacks more efficient.

== Mitigations==
To continue using email encryption securely, users must implement the following points
To prevent EFAIL attacks. This section is divided in to three terms to visualize the
urgency of each implementation.

=== Short-Term ===
Active content in the email client must be disabled. This includes HTML code execu-
tion and the reloading of external material, which is frequently authorized for aesthetic
reasons. E-mail servers and e-mail clients must be secured against unauthorized access
attempts.Moreover, in the case of OpenPGP, you can decrypt the e-mails in an external
program instead of in the mail client, so that an attack comes to nothing.
Short term: No decryption in email client. Decrypting S/MIME or PGP emails in a
separate program outside of your email client is the easiest strategy to avoid EFAIL
attacks. Decrypt incoming encrypted emails by copy and pasting the ciphertext into
a different program that handles the decryption for you after deleting your S/MIME
and PGP private keys from your email client. In this manner, email clients are unable
to initiate exfiltration channels. This is currently the safest option with the downside
that the process gets more involved.
Short term: Disable HTML rendering. The EFAIL attacks target active content, which
is often in the form of HTML pictures, styles, and other elements. The most common
approach of fighting EFAIL is to disable the rendering of incoming HTML emails in
your email client. It’s worth noting that email clients have other possible backchannels
that aren’t linked to HTML, but they’re more difficult to attack.
=== Mid-Term ===
Mid term: Update E-Mail client. Vendors of the email clients will publish patches that
either fix the E-Fail vulnerabilities or make them much harder to exploit.
=== Long-Term ===
Long term: Update OpenPGP and S/MIME standards. The EFAIL attacks exploit
flaws and undefined behavior in the MIME, S/MIME, and OpenPGP standards.As a
result, standards must be changed, which will take time. Update: Our advice to dep-
recate the SE packet type and not show updated ciphertexts is reflected in the current
draft of OpenPGP RFC4880.[CalAD]
The CFB gadget attacks can also be prevented by updates, the programs just have to
evaluate the MDC correctly (which GnuPG does by now, an error in the MDC check
now leads to termination) and reject the outdated SE packets so that the attacks are
no longer possible.
The CBC gadget attacks cannot be properly prevented until an updated S/MIME
standard is released. Until that time comes, individual developers will have to develop
their own solutions
11

== Conclusion ==

== References ==

CalAD] J. Callas. Rfc4880, Nov 200AD. URL: https://datatracker.ietf.org/
doc/html/rfc4880. 11
[Cor19] MITRE Corporation, 2019. URL: https://cve.mitre.org/cgi-bin/
cvename.cgi?name=CVE-2019-13050. 7
[Gar96] Simson Garfinkel. PGP: Pretty good privacy. O’Reilly, Internat. Thomson-
Verl, 1996. 5
[MKP+17] Juan Ram ́on Ponce Mauri ́es, Kat Krol, Simon Parkin, Ruba Abu-Salma,
and M. Angela Sasse. Dead on arrival: Recovering from fatal flaws in
email encryption tools. In The LASER Workshop: Learning from Author-
itative Security Experiment Results (LASER 2017), pages 49–57. USENIX
Association, October 2017. URL: https://www.usenix.org/conference/
laser2017/presentation/mauries. 12
[OAS21] OASIS. How email really works, 2021. [Online; accessed December
05, 2021]. URL: https://www.oasis-open.org/khelp/kmlm/user_help/
html/images/howemailworks.png. 4
[PDM+18] Damian Poddebniak, Christian Dresen, Jens Mueller, Fabian Ising, Sebas-
tian Schinzel, Simon Friedberger, Juraj Somorovsky, and Joerg Schwenk.
Efail: Breaking S/MIME and OpenPGP email encryption using exfil-
tration channels. In 27th USENIX Security Symposium (USENIX Secu-
rity 18), pages 549–566, Baltimore, MD, August 2018. USENIX Associ-
ation. URL: https://www.usenix.org/conference/usenixsecurity18/
presentation/poddebniak. 9
[Pos] J Postel. Simple mail transfer protocol. URL: https://tools.ietf.org/
html/rfc821/. 3
[Pur21] PurpleSec. 2021 ransomware statistics, Aug 2021. URL: https://
purplesec.us/resources/cyber-security-statistics/ransomware/.
6
[Ram99] B. Ramsdell. Rfc2633, Jun 1999. URL: https://datatracker.ietf.org/
doc/html/rfc2633. 4
[Rhe13] Man Rhee. Electronic Mail Security: PGP, S/MIME, pages 353–385.
Wikey, 03 2013. doi:10.1002/9781118512920.ch10. 1
14
Bibliography
[Spi16] Dag Spicer. Raymond tomlinson: Email pioneer, part 1. IEEE Annals of
the History of Computing, 38:72–79, 04 2016. doi:10.1109/MAHC.2016.25.
1
[TR10] S Turner and B Ramsdell. Rfc5751, Jan 2010. URL: https://
datatracker.ietf.org/doc/html/rfc5751. 4
[Uni21a] University of Applied Sciences M ̈unster. Cbc gadgets in s/mime, 2021.
[Online; accessed December 05, 2021]. URL: https://efail.de/media/
img/smime-attack.png. 8
[Uni21b] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil1.png. 8
[Uni21c] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil2.png. 9
[Uni21d] University of Applied Sciences M ̈unster. Direct exfiltration, 2021. [On-
line; accessed December 05, 2021]. URL: https://efail.de/media/img/
exfil3.png. 9
[[Category:Documentation]]

File:Exfil3.png

2021-12-05T22:50:33Z

KBeboso:

File:Exfil2.png

2021-12-05T22:50:16Z

KBeboso:

File:Exfil1.png

2021-12-05T22:49:29Z

KBeboso: