E-Fail - Revision history

NKirnbauer: fixed link

2024-09-25T10:02:16Z

fixed link

← Older revision		Revision as of 10:02, 25 September 2024
Line 237:		Line 237:

	== Course ==		== Course ==
	Ausgewählte Kapitel der IT-Security ~~ILV~~		[[Ausgewählte Kapitel der IT-Security]]

	== References ==		== References ==

NKirnbauer: gendering

2024-09-11T16:14:43Z

gendering

← Older revision		Revision as of 16:14, 11 September 2024
Line 27:		Line 27:

	== Email Standards ==		== Email Standards ==
	Email Encrpytion can be done in different ways. The two most common standard for email end-to-end encryption are OpenPGP and S/MIME. The messages are decrypted on the recipient's device after they have been encrypted on the sender's device. A public key is used for encryption and a private key for decryption. The communication partners exchange their public keys before using the encryption and then encrypt the emails with the respective public key of the recipient. Only the recipient can decrypt the message with ~~his~~ private key. Since the protection of the private key is elementary, it is kept on your own end device and must not be passed on.		Email Encrpytion can be done in different ways. The two most common standard for email end-to-end encryption are OpenPGP and S/MIME. The messages are decrypted on the recipient's device after they have been encrypted on the sender's device. A public key is used for encryption and a private key for decryption. The communication partners exchange their public keys before using the encryption and then encrypt the emails with the respective public key of the recipient. Only the recipient can decrypt the message with their private key. Since the protection of the private key is elementary, it is kept on your own end device and must not be passed on.

	=== OpenPGP ===		=== OpenPGP ===

NKirnbauer: fixed links

2024-09-04T07:11:00Z

fixed links

NKirnbauer: fixed links

2024-09-04T06:45:45Z

fixed links

← Older revision		Revision as of 06:45, 4 September 2024
Line 1:		Line 1:

	[[File:Logo.png\|200px\|thumb\|middle\|<ref>~~http://web.archive.org/web/20180717144701/~~https://efail.de/media/img/logo.svg/</ref>]]		[[File:Logo.png\|200px\|thumb\|middle\|<ref>https://efail.de/media/img/logo.svg</ref>]]

	== Introduction ==		== Introduction ==
Line 45:		Line 45:
	first body part.		first body part.

	[[File:exfil1.png\|200px\|thumb\|middle\|Modified Direct-Exfiltration-S/MIME-Email<ref>https://efail.de/media/img/exfil1</ref>]]		[[File:exfil1.png\|200px\|thumb\|middle\|Modified Direct-Exfiltration-S/MIME-Email<ref>https://efail.de/media/img/exfil1.png</ref>]]

	[[File:exfil2.png\|200px\|thumb\|middle\|Client's modified Direct-Exfiltration-S/MIME-Email<ref>https://efail.de/media/img/exfil2</ref>]]		[[File:exfil2.png\|200px\|thumb\|middle\|Client's modified Direct-Exfiltration-S/MIME-Email<ref>https://efail.de/media/img/exfil2.png</ref>]]

	This email is then sent to the victim by the assailant. The victim's client		This email is then sent to the victim by the assailant. The victim's client
Line 54:		Line 54:
	line 1 is disabled in line 4, so the URL includes all four lines.		line 1 is disabled in line 4, so the URL includes all four lines.

	[[File:exfil3.png\|200px\|thumb\|middle\|Decrypted Ciphertext<ref>https://efail.de/media/img/exfil3</ref>]]		[[File:exfil3.png\|200px\|thumb\|middle\|Decrypted Ciphertext<ref>https://efail.de/media/img/exfil3.png</ref>]]

	Then, the email client URL encodes all non-printable characters (e.g. ”20” is a		Then, the email client URL encodes all non-printable characters (e.g. ”20” is a
Line 84:		Line 84:
	the vulnerabilities.		the vulnerabilities.

	[[File:smime-attack.png\|200px\|thumb\|middle\|CBC gadgets in S/MIME<ref>https://efail.de/media/img/smime-attack</ref>]]		[[File:smime-attack.png\|200px\|thumb\|middle\|CBC gadgets in S/MIME<ref>https://efail.de/media/img/smime-attack.png</ref>]]

	Despite the fact that the CBC-/CFB-Gadget-Attacks on PGP and S/MIME are		Despite the fact that the CBC-/CFB-Gadget-Attacks on PGP and S/MIME are

NKirnbauer: expired links changed with links from wayback machine

2024-09-03T12:42:34Z

expired links changed with links from wayback machine

← Older revision		Revision as of 12:42, 3 September 2024
Line 1:		Line 1:

	[[File:Logo.png\|200px\|thumb\|middle\|<ref>https://efail.de/media/img/logo.svg/</ref>]]		[[File:Logo.png\|200px\|thumb\|middle\|<ref>http://web.archive.org/web/20180717144701/https://efail.de/media/img/logo.svg/</ref>]]

	== Introduction ==		== Introduction ==
Line 30:		Line 30:

	=== OpenPGP ===		=== OpenPGP ===
	PGP <ref>https://www.ietf.org/rfc/rfc4880.txt/</ref> is an end-to-end encryption standard that was developed by Phil Zimmermann in 1991 and is mainly used in email communication. Emails as well as directories, files and documents are signed and encrypted with it. In email communication, PGP is based on a hybrid encryption method in which the public keys are exchanged by the communication partners without a central certification authority standing in between. Compression, public-key encryption, symmetric encryption, digital signatures and the Web of Trust (WoT) are important technologies on which PGP is built. PGP allows users to send encrypted messages and to check whether a message is authentic. This prevents information from being modified unnoticed and enables secure and private email communication.		PGP <ref>http://web.archive.org/web/20180410064540/https://www.ietf.org/rfc/rfc4880.txt/</ref> is an end-to-end encryption standard that was developed by Phil Zimmermann in 1991 and is mainly used in email communication. Emails as well as directories, files and documents are signed and encrypted with it. In email communication, PGP is based on a hybrid encryption method in which the public keys are exchanged by the communication partners without a central certification authority standing in between. Compression, public-key encryption, symmetric encryption, digital signatures and the Web of Trust (WoT) are important technologies on which PGP is built. PGP allows users to send encrypted messages and to check whether a message is authentic. This prevents information from being modified unnoticed and enables secure and private email communication.

	=== S/MIME ===		=== S/MIME ===
	S/MIME <ref>https://www.ietf.org/rfc/rfc2311.txt/</ref> is an extension of the MIME standard with which emails are encrypted, signed or both operations are carried out using hybrid algorithms in email communication. This standard includes cryptographically secure features such as email authentication, message integrity, non-repudiation of the sender, privacy and data security. S/MIME is based on the X.509 Public Key Authority to exchange and validate the public keys of the communication partners. S/MIME uses the X.509v3 certificate and is defined in RFC 2311. All users require a valid X.509 public key certificate signed by a Certificate Authority (CA). This certificate is embedded in all outgoing messages from the sender to distribute the sender's public key. Therefore, the recipient's email client decrypts messages encrypted with S/MIME and extracts the sender's certificate, which contains the public key. Well-known email clients that support S/MIME are MS Outlook, Mozilla Thunderbird and Apple Mail.		S/MIME <ref>http://web.archive.org/web/20180406215109/https://www.ietf.org/rfc/rfc2311.txt/</ref> is an extension of the MIME standard with which emails are encrypted, signed or both operations are carried out using hybrid algorithms in email communication. This standard includes cryptographically secure features such as email authentication, message integrity, non-repudiation of the sender, privacy and data security. S/MIME is based on the X.509 Public Key Authority to exchange and validate the public keys of the communication partners. S/MIME uses the X.509v3 certificate and is defined in RFC 2311. All users require a valid X.509 public key certificate signed by a Certificate Authority (CA). This certificate is embedded in all outgoing messages from the sender to distribute the sender's public key. Therefore, the recipient's email client decrypts messages encrypted with S/MIME and extracts the sender's certificate, which contains the public key. Well-known email clients that support S/MIME are MS Outlook, Mozilla Thunderbird and Apple Mail.

	== Direct Exfiltration Channels in Email Clients ==		== Direct Exfiltration Channels in Email Clients ==

BMarkulj at 06:49, 8 January 2023

2023-01-08T06:49:16Z

← Older revision		Revision as of 06:49, 8 January 2023
Line 240:		Line 240:

	== References ==		== References ==


			[[Category:Documentation]]

BMarkulj at 16:01, 7 January 2023

2023-01-07T16:01:26Z

Show changes

BMarkulj at 15:12, 7 January 2023

2023-01-07T15:12:01Z

← Older revision		Revision as of 15:12, 7 January 2023
Line 22:		Line 22:

	== Background ==		== Background ==
	Damian Poddebniak et al. from the Münster University of Applied Sciences and the Ruhr University Bochum discovered the EFAIL vulnerabilities on November 24, 2017, submitted a paper to the 27th USENIX Security Symposium in Baltimore on May 13, 2018 and published it. The symposium was held on August 15-17, 2018. The researchers carry out attacks on email communication. The most important blocks for such attacks are backchannels, which are functions that interact with the network. They are used to create exfiltration channels for the plaintext. They enable to forward the plaintext to the attacker. The paper also examines what options attackers have to convert a backchannel into an exfiltration channel in order to get the plaintext. The researchers show that 23 out of 35 tested S/MIME and 10 out of 28 tested OpenPGP email clients are vulnerable <ref>https://www.~~efail~~.de/</ref>.		Damian Poddebniak et al. from the Münster University of Applied Sciences and the Ruhr University Bochum discovered the EFAIL vulnerabilities on November 24, 2017, submitted a paper to the 27th USENIX Security Symposium in Baltimore on May 13, 2018 and published it. The symposium was held on August 15-17, 2018. The researchers carry out attacks on email communication. The most important blocks for such attacks are backchannels, which are functions that interact with the network. They are used to create exfiltration channels for the plaintext. They enable to forward the plaintext to the attacker. The paper also examines what options attackers have to convert a backchannel into an exfiltration channel in order to get the plaintext. The researchers show that 23 out of 35 tested S/MIME and 10 out of 28 tested OpenPGP email clients are vulnerable <ref>https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak/</ref>.

	EFAIL includes security threats that attackers can use to read sensitive content despite working encryption in OpenPGP and S/MIME. The two vulnerabilites allow attackers to obtain the plaintext or parts of the plaintext of an encrypted email and to transmit it to a compromised server. Such attacks require that the used encryption method is vulnerable, the email system actively executes HTML content or JavaScript files and that external content is reloaded. Despite working OpenPGP or S/MIME encryption an attacker can intercept emails and process them in order to transmit the content of the email or at least parts of it as plaintext to the attacker's server. The attacker can make changes to the emails so that confidential content is forwarded to unauthorized persons when the message is loaded by the victim's client. However, it is improtant to note here that the attacker needs prior access to emails before executing such attacks and that EFAIL is not a security threat which affects encryption, neither symmetric nor asymmetric encryption.		EFAIL includes security threats that attackers can use to read sensitive content despite working encryption in OpenPGP and S/MIME. The two vulnerabilites allow attackers to obtain the plaintext or parts of the plaintext of an encrypted email and to transmit it to a compromised server. Such attacks require that the used encryption method is vulnerable, the email system actively executes HTML content or JavaScript files and that external content is reloaded. Despite working OpenPGP or S/MIME encryption an attacker can intercept emails and process them in order to transmit the content of the email or at least parts of it as plaintext to the attacker's server. The attacker can make changes to the emails so that confidential content is forwarded to unauthorized persons when the message is loaded by the victim's client. However, it is improtant to note here that the attacker needs prior access to emails before executing such attacks and that EFAIL is not a security threat which affects encryption, neither symmetric nor asymmetric encryption.

	== Email-Standards ==		== Email Standards ==
	Email Encrpytion can be done in different ways. The two most common standard for email end-to-end encryption are OpenPGP and S/MIME. The messages are decrypted on the recipient's device after they have been encrypted on the sender's device. A public key is used for encryption and a private key for decryption. The communication partners exchange their public keys before using the encryption and then encrypt the emails with the respective public key of the recipient. Only the recipient can decrypt the message with his private key. Since the protection of the private key is elementary, it is kept on your own end device and must not be passed on.		Email Encrpytion can be done in different ways. The two most common standard for email end-to-end encryption are OpenPGP and S/MIME. The messages are decrypted on the recipient's device after they have been encrypted on the sender's device. A public key is used for encryption and a private key for decryption. The communication partners exchange their public keys before using the encryption and then encrypt the emails with the respective public key of the recipient. Only the recipient can decrypt the message with his private key. Since the protection of the private key is elementary, it is kept on your own end device and must not be passed on.

BMarkulj at 14:28, 7 January 2023

2023-01-07T14:28:30Z

← Older revision		Revision as of 14:28, 7 January 2023
Line 63:		Line 63:

	[[File:clients.png\|200px\|thumb\|right\|Vulnerable email programs to the knowledge of the security researchers		[[File:clients.png\|200px\|thumb\|right\|Vulnerable email programs to the knowledge of the security researchers
	who discovered the EFAIL vulnerabilities.<ref>https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak</ref>]]		who discovered the EFAIL vulnerabilities <ref>https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak</ref>]]

	== The CBC-/CFB-Gadget-Attack ==		== The CBC-/CFB-Gadget-Attack ==

BMarkulj at 14:12, 7 January 2023

2023-01-07T14:12:59Z

Show changes

← Older revision		Revision as of 07:11, 4 September 2024
Line 45:		Line 45:
	first body part.		first body part.

	[[File:exfil1.png\|200px\|thumb\|middle\|Modified Direct-Exfiltration-S/MIME-Email<ref>https://efail.de/media/img/exfil1.png</ref>]]		[[File:exfil1.png\|200px\|thumb\|middle\|Modified Direct-Exfiltration-S/MIME-Email<ref>[https://efail.de/media/img/exfil1.png https://efail.de/media/img/exfil1.png ]</ref>]]

	[[File:exfil2.png\|200px\|thumb\|middle\|Client's modified Direct-Exfiltration-S/MIME-Email<ref>https://efail.de/media/img/exfil2.png</ref>]]		[[File:exfil2.png\|200px\|thumb\|middle\|Client's modified Direct-Exfiltration-S/MIME-Email<ref>[https://efail.de/media/img/exfil2.png https://efail.de/media/img/exfil2.png ]</ref>]]

	This email is then sent to the victim by the assailant. The victim's client		This email is then sent to the victim by the assailant. The victim's client
Line 54:		Line 54:
	line 1 is disabled in line 4, so the URL includes all four lines.		line 1 is disabled in line 4, so the URL includes all four lines.

	[[File:exfil3.png\|200px\|thumb\|middle\|Decrypted Ciphertext<ref>https://efail.de/media/img/exfil3.png</ref>]]		[[File:exfil3.png\|200px\|thumb\|middle\|Decrypted Ciphertext<ref>[https://efail.de/media/img/exfil3.png https://efail.de/media/img/exfil3.png ]</ref>]]

	Then, the email client URL encodes all non-printable characters (e.g. ”20” is a		Then, the email client URL encodes all non-printable characters (e.g. ”20” is a
Line 84:		Line 84:
	the vulnerabilities.		the vulnerabilities.

	[[File:smime-attack.png\|200px\|thumb\|middle\|CBC gadgets in S/MIME<ref>https://efail.de/media/img/smime-attack.png</ref>]]		[[File:smime-attack.png\|200px\|thumb\|middle\|CBC gadgets in S/MIME<ref>[https://efail.de/media/img/smime-attack.png https://efail.de/media/img/smime-attack.png ]</ref>]]

	Despite the fact that the CBC-/CFB-Gadget-Attacks on PGP and S/MIME are		Despite the fact that the CBC-/CFB-Gadget-Attacks on PGP and S/MIME are
Line 140:		Line 140:
	Update OpenPGP: The advice of Poddebniak et al. to dep-		Update OpenPGP: The advice of Poddebniak et al. to dep-
	recate the SE packet type and not show updated ciphertext is reflected in the current		recate the SE packet type and not show updated ciphertext is reflected in the current
	draft of OpenPGP RFC 4880 <ref>https://www.ietf.org/rfc/rfc4880.txt/</ref> [CalAD].		draft of OpenPGP RFC 4880 <ref>http://web.archive.org/web/20180410064540/https://www.ietf.org/rfc/rfc4880.txt/</ref> [CalAD].

	Update S/MIME: Since EFAIL the S/MIME-Standard is updated continously in order to minimize		Update S/MIME: Since EFAIL the S/MIME-Standard is updated continously in order to minimize
	the risks. The email cerntificate standard has been udpated to version 4. The IETF even		the risks. The email cerntificate standard has been udpated to version 4. The IETF even
	mentions EFAIL in RFC 8551 <ref>https://www.ietf.org/rfc/rfc8551.txt/</ref> and recommends migrating to AES-GCM to fix the		mentions EFAIL in RFC 8551 <ref>http://web.archive.org/web/20221211055934/https://www.ietf.org/rfc/rfc8551.txt</ref> and recommends migrating to AES-GCM to fix the
	EFAIL vulnerabilites. Furthermore, the decrypted content shall not be edited		EFAIL vulnerabilites. Furthermore, the decrypted content shall not be edited
	prior to the completion of an integrity check.		prior to the completion of an integrity check.
Line 159:		Line 159:

	== Controversy ==		== Controversy ==
	After the two EFAIL security threats were published, media reported that experts advise against email encryption with OpenPGP and S/MIME. The topic was luridly taken up and the encryption algorithms of OpenPGP and S/MIME were described as compromised. Furthermore, the Electronic Frontier Foundation released information on EFAIL earlier than agreed with Poddebniak et al. and advised against the use of the two standards. This caused significant damage to the image of S/MIME and OpenPGP and prompted numerous users to dispense email encryption. The EFAIL vulnerabilities did not cause any significant economic damage. However, the signaling effect of the two vulnerabilities and how they were communicated is problematic. Damian Poddebniak et al. are strongly criticized by security experts for the way EFAIL was published. The media boycott by the researchers and their website make it appear that the researchers wanted to attract lot of attention. <br /> Security experts have been recommending encrypting emails for years. EFAIL has contributed to questioning the confidence of many users in encryption methods, although the root causes of EFAIL are not the encryption methods. The problem with the two vulnerabilities is the outdated implementation of the two email standards. Data of different data types are not properly separated from each other and this leads to risky misinterpretations by the email client <ref>https://www.dfn-cert.de/aktuell/efail.html/</ref>.		After the two EFAIL security threats were published, media reported that experts advise against email encryption with OpenPGP and S/MIME. The topic was luridly taken up and the encryption algorithms of OpenPGP and S/MIME were described as compromised. Furthermore, the Electronic Frontier Foundation released information on EFAIL earlier than agreed with Poddebniak et al. and advised against the use of the two standards. This caused significant damage to the image of S/MIME and OpenPGP and prompted numerous users to dispense email encryption. The EFAIL vulnerabilities did not cause any significant economic damage. However, the signaling effect of the two vulnerabilities and how they were communicated is problematic. Damian Poddebniak et al. are strongly criticized by security experts for the way EFAIL was published. The media boycott by the researchers and their website make it appear that the researchers wanted to attract lot of attention. <br /> Security experts have been recommending encrypting emails for years. EFAIL has contributed to questioning the confidence of many users in encryption methods, although the root causes of EFAIL are not the encryption methods. The problem with the two vulnerabilities is the outdated implementation of the two email standards. Data of different data types are not properly separated from each other and this leads to risky misinterpretations by the email client <ref>http://web.archive.org/web/20230603213824/https://www.dfn-cert.de/aktuell/efail.html</ref>.

	== Conclusion ==		== Conclusion ==