Monday, 28 May, 2018

Security Alert: Stop using PGP and S/MIME now!

Daniel Sambraus—EyeEm  Getty Images Daniel Sambraus—EyeEm Getty Images
Terence Owen | 14 May, 2018, 19:14

Users of platforms that use S/MIME and PGP encryption have been advised to disable email encryption to avoid the chances of an attack.

"There are now no reliable fixes for the vulnerability", lead researcher Sebastian Schinzel, professor of applied cryptography at the Muenster University of Applied Sciences, said on Monday.

European researchers have found that the popular PGP and S/MIME email encryption standards are vulnerable to being hacked, leading them to urge people to disable and uninstall them immediately. Anyone who wants their email communication to be secure and private should take notice.

Werner Koch of GnuPG, a popular provider of GPG encryption, said the vulnerability was not in the encryption protocols, but rather, in the email clients used to decrypt them.

More particularly, the attacks use specially crafted HTML emails that exploit bugs in the way PGP is implemented in some email programs.

PGP is used by activists, journalists and whistleblowers, including Edward Snowden, who revealed details of pervasive electronic surveillance by U.S. intelligence agencies before fleeing to Russian Federation. By also including the Web address of an attacker-controlled server, the newly sent emails can cause the programs to send the corresponding plaintext to the server. The researchers explain that there are two main types: Direct exfiltration attacks (which target weak points in Apple Mail, iOS Mail and Mozilla Thunderbird) and CBC/CFB gadget attacks.

Overwatch anniversary event date and new Junkrat skin revealed
New items include eight Legendary skins and three Epic skins, and additional dance emotes for Doomfist, Moira, and Brigitte. This version is called the Legendary Edition and will include Legendary, Epic, and Origin skins with 15 skins in total.

During the tests, which have been quickly dubbed "Efail" by German media, the team was able to trick computers into covertly forwarding them decrypted messages.

The researchers note that S/MIME uses Cipher Block Chaining, while OpenPGP uses Cipher Feedback, both of which are exploitable in similar ways.

While the requirement that attackers have access to previously sent e-mails is a an extremely high bar, the entire objective of both PGP and S/MIME is to protect users against this possibility.

Another short term fix that the security researchers suggest is that OpenPGP and S/MIME users decrypt emails, outside of their primary email client. Then the emails are changed in a particular way and sent to a victim.

Security researchers, backed up the EFF, have issued a warning over PGP and S/MIME encryption. In addition the mails would need to be in HTML format and have active links to external content to be vulnerable.

Recommended

Simon Yates wins to extend lead, Chris Froome fades Simon Yates wins to extend lead, Chris Froome fades But he struggled at the end of the 225K (140-mile) route from Pesco Sannita up to Gran Sasso d'Italia and finished well down. I had the power, I knew what I was capable of, but it's one thing having the belief and another thing doing it.

Will Power Wins Third Grand Prix Will Power Wins Third Grand Prix He put some pressure on Power but all cars were hard in fuel-saving mode to make it to the flag and he had to settle for second. Wickens fought off Alexander Rossi to keep the final podium spot, and Sebastien Bourdais got around Rossi to come home fourth.

Butler's 94 keeps RR alive in IPL Butler's 94 keeps RR alive in IPL It was a flawless partnership as Rahane played a run-a-ball knock, Buttler dealt in with fours and sixes to get the things going. Buttler (415 runs), Sanju Samson (353 runs) have been the top two batsmen for them and expectations will be high on them.

Monster Hunter movie by Resident Evil director will star Milla Jovovich Monster Hunter movie by Resident Evil director will star Milla Jovovich Beyond that, Constantin will finance " Monster Hunter " itself. "He can make a movie look good, is very much into visuals". That's what it's all about these days, a fresh, different approach", said the company.

Long lost massive asteroid to pass close by the Earth Long lost massive asteroid to pass close by the Earth The 2010 sign means that it was initially detected in 2010, particularly on November 30, by the Catalina Sky Survey in Arizona . The experts, not being able to completely comprehend the asteroid , again re-imaged it on 10 May and named it as 2010 WC9.

Woman slams into back of truck on Bangerter Highway Woman slams into back of truck on Bangerter Highway Police in Utah are investigating whether a fast-moving Tesla auto that rear-ended a fire truck on Friday was in autopilot mode. There was light rain during that night and the roads at that location were wet enough to cause an unlikely slippage.

PM Modi 'Influencing' Karnataka Elections By Visiting Nepal, Says Congress PM Modi 'Influencing' Karnataka Elections By Visiting Nepal, Says Congress Prime Minister Modi will also attend a civic reception to be hosted in his honour by the Kathmandu Metropolitan City. The local administration had put in place a special security plan to make Modi's visit safe and systematic.

Manchester United beat Watford 1-0 on Carrick's farewell Manchester United beat Watford 1-0 on Carrick's farewell But Mourinho insisted his absence was purely down to an injury that could also see him miss next Saturday's showpiece. But he later revealed the France global had suffered an injury on Friday and could not train on Saturday.

Justice De Castro denies 'bias,' 'personal interest' in Sereno ouster Justice De Castro denies 'bias,' 'personal interest' in Sereno ouster Sereno has been at loggerheads with President Rodrigo Duterte and has urged Filipinos to stand up to his authoritarian rule. She is the second top judge to lose the position after her predecessor was impeached for non-disclosure of wealth.

Bolton says 'it's possible' U.S. will sanction European companies working with Iran Bolton says 'it's possible' U.S.  will sanction European companies working with Iran Zarif's statement said that with the USA withdrawal from the deal, Iran is prepared to embark on the 2025 enrichment project now. Equally forceful was his colleague, Economy Minister Bruno Le Maire, who said Europe had to defend its "economic sovereignty".

WB Panchayat polls: Stray incidents of violence WB Panchayat polls: Stray incidents of violence A CPM worker and his wife were locked inside their home and burnt alive hours before the panchayat polls in West Bengal. They also accused the ruling Trinamool for unleashing a reign of terror during the nomination process for the polls.

Nintendo Announces Re-Stock of NES Classic Edition This June Nintendo Announces Re-Stock of NES Classic Edition This June You don't need to worry about finding space to store all 30 of the games either: They're installed directly on the console. This is great news for gamers who weren't able to get their hands on the NES Classic the first time around.

New Leak of OnePlus 6 Shows Its Beautiful Design and Confirms Price New Leak of OnePlus 6 Shows Its Beautiful Design and Confirms Price The company has previously confirmed the OnePlus 6 would be coming equipped with up to 8GB of RAM and up to 256GB of storage. The primary camera is expected to sport dual 16MP sensors with 20MP snapper upfront for selfies and video calling.

Iran preps 'industrial-scale' nuke production after USA leaves nuclear deal Iran preps 'industrial-scale' nuke production after USA  leaves nuclear deal Israel had already acknowledged launching more than 100 airstrikes in Syria since that country's civil war broke out in 2011. At least 11 Iranians were among those killed in unprecedented Israeli strikes on Syria this week, a monitor said Saturday.

Raazi box office collection Day 3: Alia's film continues its dream run Raazi box office collection Day 3: Alia's film continues its dream run After witnessing a massive jump in its business on Saturday, the spy thriller performed even better on Sunday. Her latest release Raazi is a proof that she is a future female superstar of Bollywood.