Researchers reveal flaws that may expose encrypted emails to prying eyes

Tomáš Foltýn 

A team of academics says that, if exploited, the vulnerabilities can reveal the plain text of encrypted emails, including those sent years ago

The widely-used OpenPGP and S/MIME email encryption protocols suffer from weaknesses that may ultimately expose the plain text of encrypted messages to attackers, according to a team of eight academics from German and Belgian universities, who have nicknamed the flaws “EFAIL”.

“In a nutshell, EFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plain text through requested URLs,” the researchers wrote on efail.de, a newly-launched website dedicated to their findings. The vulnerabilities come in two flavors and are described in great detail in a technical paper entitled “Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels”.

In order to exploit the weaknesses, miscreants first need to access the end-to-end encrypted email message. This means intercepting it in transit or stealing it, for instance, from a compromised email account, client computer or backup system. Then, the attackers need to alter the email by adding custom HTML code to it, and send the manipulated email to the victim. The victim’s email client decrypts the email and, given its HTML-rendering capability, it is tricked by the malicious code into sending the full plain text of the emails to the attackers. Even messages sent years ago are vulnerable.

The team also said that their proof-of-concept exploit has been shown to be successful against 25 out of 35 tested S/MIME email clients and 10 out of 28 OpenPGP clients. The flaws affect email applications such as Apple Mail with the GPGTools encryption plug-in, Mozilla Thunderbird with the Enigmail plug-in, and Outlook with the Gpg4win encryption package. The academics said that, in keeping with the principles of responsible disclosure, they have reported their findings to email providers concerned.

They also averred that there are no reliable fixes for the vulnerability and recommended several short-, medium-, and long-term mitigation strategies. The short-term actions involve decrypting emails in a separate application rather than in the email client, together with disabling the rendering of remote content, such as HTML images or styles. As for medium- and long-term fixes, respectively, the academics said that software holes need to be patched and the standards need to be updated.

The Electronic Frontier Foundation (EFF), a US-based digital rights group, had reviewed the researchers’ findings before they were published. On Sunday, it released a series of tutorials in which it largely echoed the researchers’ advice – users should disable or uninstall PGP plugins in their email handlers until the vulnerabilities are patched. Since the same flaws affect S/MIME, which is common in enterprise email networks, EFF recommended that, “during this period of uncertainty”, users should switch to alternative methods of secure communication.

Broken encryption, broken embargo

The research attracted a great deal of publicity even before its results was published. This was after the researchers initially released a “teaser” to the effect that the flaws would be described in detail in a paper on Tuesday. However, the embargo was broken on Monday, prompting the researchers to go public with their findings ahead of schedule.

Meanwhile, the findings have stirred some controversy, in particular over how realistic the threat truly is. For example, Robert J. Hansen of Enigmail dismissed the alarm bells as “a tempest in a teapot”.

In a similar vein, Werner Koch, the man behind GNU Privacy Guard (GnuPG/GPG), which is an implementation of OpenPGP, called the warnings “overblown”.

In fact, according to GnuPG, the problem lies elsewhere. “They figured out mail clients which don’t properly check for decryption errors and also follow links in HTML mails. So the vulnerability is in the mail clients and not in the protocols. In fact OpenPGP is immune if used correctly while S/MIME has no deployed mitigation,” GnuPG tweeted.

ProtonMail said in a statement that its encrypted email service is not affected by the flaws and that, beyond “one minor exception”, the vulnerabilities are not, in fact, present in PGP itself. “What the authors of Efail did was catalogue a list of PGP clients that have errors in their PGP implementation,” reads the statement. With that in mind, the company recommended the use of secure PGP implementations.

Cryptographer and professor at Johns Hopkins University Matthew Green said of the exploit that “[i]t’s an extremely cool attack and kind of a masterpiece in exploiting bad crypto, combined with a whole lot of sloppiness on the part of mail client developers.”

Cryptography expert Bruce Schneier weighed in by saying that “[t]he vulnerability isn’t with PGP or S/MIME itself, but in the way they interact with modern e-mail programs.”

https://www.welivesecurity.com/2018/05/15/researchers-reveal-flaws-encrypted-emails/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

WannaCryptor: The curious tale of a ravenous cryptoworm

Tomáš Foltýn

Do you still remember how WannaCryptor ran its – winding – course? It was a tale that revealed a number of intriguing plot lines amid the ransomworm’s numerous twists and turns.

You’ve no doubt heard about WannaCryptor, aka WannaCry or WCrypt, many times before, but there may still be things that have escaped you in the general hubbub of daily life. Here are a few tidbits that helped make WannaCryptor – and, indeed, the people involved with it in a good or bad way – stand out.

No need to play ball

First, unlike many of its malicious peers and contrary to initial reports, WannaCryptor did not rely on duping the target into clicking on a link in, or attachment to, a malicious email. Instead, the malware leveraged a software exploit known as EternalBlue. This tool, allegedly developed by the United States’ National Security Agency (NSA) and then stolen and dumped online by the Shadow Brokers hacking group, targeted a critical flaw in an outdated version of Microsoft’s Server Message Block (SMB) implementation, which is used mainly for file- and printer-sharing in corporate networks.

Having scanned the internet for machines with port 445 (conventionally associated with SMB) open, the attackers exploited the SMB flaw and went on to install another tool, DoublePulsar, thought to have been stolen from the NSA. This backdoor paved the way for the main payload that, once implanted and executed, encrypted the files.

Importantly, Microsoft released a critical security update for this vulnerability a full 59 days before the global outbreak. Furthermore, ports associated with any of the three SMB versions should never be exposed to the internet. In addition, Microsoft had advised a long time before the attack that the first version of SMB (SMBv1), which is some three decades old and for which the patch had also been released, should no longer be used. The bottom line? A compromise by WannaCryptor was completely avoidable even in the absence of an installed patch, simply by applying some basic security configurations. This, in fact, applies to measures against malware in general, as it often targets open ports and then exploits known software flaws.

Writhing worm and old’s cool

WannaCryptor’s worm-esque functionality had some eerie echoes of techniques from the days of yore (in computer terms, anyway). In fact, security folks had expected that ransomware would come to be paired with self-propagating worms to greatly aid and abet the main payload’s spread. Much like old-school worms – think Code Red in 2001, SQL Slammer in 2003, Sasser in 2004, and Conficker in 2008 – WannaCryptor, too, traversed vulnerable corporate networks voraciously, feeding off a security loophole for which a patch had been available for quite a while. This time, the malware packed a particularly powerful punch in that its main payload was ransomware that completely incapacitated the affected machines. “History doesn’t repeat itself, but it often rhymes”, as Mark Twain is sometimes believed to have said.

Once in a machine, WannaCryptor leveraged its worm functionality to feed on other vulnerable devices within the local network and on the open internet. As soon as another exposed machine was found and compromised courtesy of the same unpatched SMB loophole, it was abused for “paying it forward”, continuing the vicious cycle of compromising computers, encrypting files, and demanding ransom.

 The “deal” gone awry

Speaking of the main payload, ESET Senior Research Fellow David Harley recently pointed out that the malware’s operators were very unlikely to keep their side of the bargain even if the victims held up theirs. To elaborate on that point – there was no automated or practicable way for the attackers to know which victim had paid up and which had not. How can you possibly share an unlock code if you can’t ascertain if the victim has paid up?

In fact, the money side of things failed precipitously for the attackers considering the extent of the campaign and the damage it wrought – some 300,000 machines compromised, each in potential exchange for $300 (or, after three days, $600) for the decryption key. When the dust settled, the operators of the three Bitcoin wallets associated with WannaCryptor – to date unknown, by the way – emptied them in late July and early August, moving around some 52 bitcoin, worth US$140,000 at that time. If the attackers were indeed cashing out, it was hardly a windfall given the scale of the attack and the fact that many other ransomware campaigns rake in millions in profits with much less brouhaha and far fewer victims.

This, combined with some other quirks of WannaCryptor, has prompted many security practitioners to believe that the malware was never intended to be a money-grubbing machine. Instead, it has been called an elaborate disk trasher, or it may have been planned as a small operation that ended up getting out of hand.

Ten bucks

It’s not only in the Matrix that “everything that has a beginning has an end” (I left out “Neo” on purpose here). How did the WannaCryptor outbreak stop – for the most part, anyway? In a most anti-climactic fashion – with a “switch“.

As WannaCryptor was being foisted on users throughout the world, a 22-year-old malware analyst from England dived into samples of the code, noticing something peculiar about its behavior. The researcher, a Marcus Hutchins aka MalwareTech, saw that the malware tried to connect to a gibberish – and unregistered – domain.

Then, doing what those who track botnets for a living often do, he took possession of the domain for the sake of further insight into, and ultimately to stop, the attackers’ shenanigans. Except that this time, first, there was no botnet involved and, second, Hutchins apparently had no clue that, by buying the domain (for less than US$10) and making it “live”, the malware’s “kill switch” would be turned on. Thereafter, whenever WannaCryptor connected to the domain, the malware simply shut down, rather than starting its spreading and disk-encrypting routines. This was instrumental in slowing WannaCryptor’s propagation to a trickle within a few hours, earning Hutchins the possibly undeserved designation “[accidental] hero”.

In an odd twist – and much to the astonishment of many members of the security community – Hutchins was arrested at the Las Vegas airport in early August on charges that he had helped develop and spread a banking Trojan called Kronos (detected by ESET as Win32/Agent.QMH) in 2014 and 2015. The next month, security journalist Brian Krebs published a long piece, connecting Hutchins to several possibly unsavory online personas. Hutchins, who is now on bail pending trial and denies any wrongdoing, may face 40 years in jail.

On set

With WannaCryptor firmly in the rearview mirror, let’s hope … er, no, let’s not. “Hope is not a strategy,” as some prominent people, including film director James Cameron, have averred. Instead, let’s learn the lessons offered by the outbreak unless we want to provide fodder for a disaster movie. As far as I’m concerned, the tale of the WannaCryptor outbreak and much of what happened in its wake has all the makings of a Hollywood script.

https://www.welivesecurity.com/2018/05/14/wannacryptor-curious-tale/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Are firms and regulators prepared for GDPR?

The answer may hinge on if you’re a glass-half-full or glass-half-empty kind of person. While we’re at it, how about regulators’ level of preparedness, anyway?

With the enforcement of the General Data Protection Regulation (GDPR) just two weeks away on May 25 , organizations in the United Kingdom are further ahead in their preparations to comply with the law’s requirements than their peers elsewhere in the European Union and in the United States, a new survey by professional IT network Spiceworks reveals.

A total of 61 percent of UK-based firms said that they are or will be fully compliant with GDPR by the deadline. For the rest of the European Union, the ratio goes down to 46 percent. Meanwhile, only one in four US-based companies that are impacted by the new legislation will be ready in time.

What’s the reason for non-compliance? That depends on whom you ask. In Europe, more than 60 percent of the respondents that will not be compliant blamed a lack of time or resources. Across the pond, the most frequent reason – for 40 percent of respondents – was simply that GDPR was not a priority for their organization.

The survey polled 625 IT professionals in organizations in the United Kingdom, the rest of the EU, and in the United States in early April.

Over to you, regulators

A not-too-dissimilar picture is actually painted when it comes to those that are supposed to oversee the implementation and enforcement of greater privacy protections.

A Reuters survey has found that 17 out of 24 national or regional watchdog authorities or data protection officers in the EU that responded to the survey are ill-prepared to fulfill their GDPR-related duties when the law takes effect.

More precisely, the regulators said that they lack the necessary funding or powers to fulfill their GDPR duties. The shortage of authority is often because national governments have yet to update their laws to incorporate the Europe-wide rules. With that in mind, most respondents said that they would investigate complaints “on merit”.

In a nutshell, GDPR is intended to give power back to EU citizens over how their personal information is processed and used, including giving them “the right to be forgotten”. This means that individuals will be able to request that businesses delete their no longer necessary or accurate personal data. In addition, the law’s serious implications include data breach notification requirements and fines for non-compliance.

Further reading

We have previously covered the topic of GDPR extensively (including in a dedicated white paper) and will continue to do so as we get closer to the May 25 deadline.

https://www.welivesecurity.com/2018/05/11/firms-regulators-prepared-gdpr/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29