This might keep Apple’s security teams for a few night working on a patch.
A group of vulnerabilities discovered in PGP and S/MIME that could allow an attacker to read emails encrypted using the standards, with one attack potentially allowing for a message to be decrypted by abusing a flaw in the way Mail for iOS and macOS renders HTML-based messages.
A team of European security engineers have posted warnings about “Efail” attacks, wherein two vulnerabilities could cause an issue for those using PGP and S/MIME plug-ins to secure their communications in email clients. Vulnerabilities in the OpenPGP and S/MIME standards enable the attacks to occur, which is said to affect emails sent to the victim, including those received months or years ago.
The vulnerabilities focus on how an email client renders HTML content within a message. In emails wherein images are loaded externally, the email can be potentially accessed or eavesdropped upon. The attacker effectively alters one of the acquired encrypted emails, sends it to the victim’s account.
Once opened and encrypted, the email client accesses the external content, which at the same time send the plaintext sections of the email to the attacker.
The researchers stated that the approach can affect “Apple Mail, iOS Mail, and Mozilla Thunderbird,” although these client can be patched to stop the “Direct Exfiltration” method from working. It is unclear if Apple has supplied patches to fix the vulnerability, but it is likely a solution is on the way if it has not yet been deployed.
A second technique, known as the “CBC/CFB Gadget Attack,” is said to affect any standards-confirming email client, but can also be patched. The researchers have advised that, in the long term, “it is necessary to update the specification (for OpenPGP and S/MIME) to find and document changes that fix the underlying root cause.”
The second method requires the precise modification of plaintext blocks if the attacker knows elements of the message. By changing certain blocks to inject an image tag into the encrypted section, the plaintext message can then get sent to the attacker once the malformed encrypted message is opened by the victim.
Where a short term fix is concerned, the researchers have advised that users disable HTML rendering for incoming images in email clients. In cases where the email client doesn’t decrypt messages, it is advised the best way to open the messages safely would be to use a separate application entirely, as this would prevent the opening of exfiltration channels.
The researchers plan to release full details of the vulnerabilities and the attacks in a paper on Tuesday morning at 3am eastern time. Today’s announcement is said by the EFF to be a warning to the “wider PGP user community in advance of its full publication.”
As always, be careful out there and stay tuned for additional details as they become available.
Via AppleInsider and eFail.de