Emails No Longer Secure – Critical Flaw Found in PGP

IT | May 28, 2018 | Master3395

Security Researchers have discovered a vulnerability in PGP or S/MIME Email Encryption methods which is currently being called EFAIL that exposes the encrypted emails in plain text even all the messages that have been transferred in the past.

“Email is no longer a secure communication medium,” Sebastian Schinzel, a professor of computer security at Germany’s Münster University of Applied Sciences, told the German news outlet Süddeutschen Zeitun. The vulnerability was reported by the Electronic Frontier Foundation on Monday Morning and the details were updated on the internet at 6 AM ET today. A group of people from news embargo are saying to stop using PGP.

The Researchers are currently saying that there is no immediate fix available for this vulnerability.

“The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In simple terms, EFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs. To create these exfiltration channels, the attacker first needs access to the encrypted emails, for example, by eavesdropping on network traffic, compromising email accounts, email servers, backup systems or client computers. The emails could even have been collected years ago.”

“The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. The victim’s email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker.”

PGP (Pretty Good Privacy) is an encryption algorithm that is considered as the Gold Standard for the security of the Emails which was first developed in 1991. The PGP encryption became the standard of the market in the 21st century but after this breach, there will be a significant reduction of clients taking advantage of this algorithm.

“They figured out mail clients which don’t properly check for decryption errors and also follow links in HTML emails. So the vulnerability is in the mail clients and not in the protocols. In fact, OpenPGP is immune if used correctly while S/MIME has no deployed mitigation,” GNU Privacy Guard said on Twitter.

Take your time to comment on this article.

Keywords: Email, not secure, secure, critical, flaw, pgp

Author: Master3395


comments powered by Disqus

Page 1 of 387  >  >>

Google tests system updates through the Play Store


Apr 22, 2019 | Category: Google | Comments

Can this help Android updates come faster?

Rumor has it that future Android updates will be delivered through Google Play. Now there are several signs that indicate this is true.

read more…

Netflix is not afraid - launches new list


Apr 21, 2019 | Category: General | Comments

Increases more than expected.

read more…

In mid-May, these come: 9th generation i9 processors with eight cores and 16 threads


Apr 20, 2019 | Category: IT | Comments

Watches in at 2.1GHz and 35W.

read more…

Page 1 of 387  >  >>