• News
  • Industry

Users Warned of Critical Email Encryption Security Flaw

Users Warned of Critical Email Encryption Security Flaw

Full details of the PGP and S/MIME flaws were due to be released on Tuesday, when the researchers appear to have negotiated a coordinated vulnerability announcement with makers of vulnerable software.

In fact, users are being advised to stop using and disable the encryption tools immediately in their email client if they use them for sensitive communications.

Cluley is among several security experts who have pointed out that Efail is not reliant on any inherent weakness in the PGP/GPG being used because it exploits users who have not told their email clients to stop remote or external content from being automatically rendered. This attack relies on a three-part message being sent. These security flaws could essentially reveal encrypted emails in plaintext even if they were sent in the past.

The attacker creates a new multipart email message and prepares it in a special way. PGP and S/MIME are said to have flaws that could be exploited to get access to any incoming or outgoing emails on platforms that use either of the two encryption tools.

PGP is often used to encrypt messages in popular email programs such as Outlook, Apple Mail, Thunderbird, and Enigmail. Efforts to make email safer haven't seen widespread adoption because these solutions are "hacks" on top of legacy infrastructure, causing an error prone and clunky user experience.

Security researchers have found vulnerabilities in some of the email encryption software.

Whistle-blowers, political activists and others who depend on encrypted email could all be compromised by the bug, the researchers said in a blog post.

The vulnerabilities in PGP and S/MIME standards pose an "immediate risk" to email communication including the potential exposure of the contents of past messages, said the Electronic Frontier Foundation, a US digital rights group. "Having used PGP since 1993, this sounds baaad".

Rather than deal with email encryption issues at all, others said, just switch to an encrypted messaging app that does not require any third-party plug-ins. "Or if you really need to read them use a proper MIME parser and disallow any access to external links", he says.

Some have been arguing that EFAIL isn't a problem for OpenPGP as long as the implementations are done correctly (in addition to the aforementioned authenticated encryption, this includes not using HTML emails, which thwarts the problem). "Use offline tools to decrpt PGP messages you have received in the past", the group said.

But if you're still anxious, you can always opt for plain-text over HTML emails - or just use Signal like everyone else. And many corporate email services employ S/MIME.

The flaws, some of which have existed for more than a decade, are part of a series of vulnerabilities dubbed Efail described by a team of European researchers.

Leave Your Comment

Leave Your Comment


Latest News

  • CBS declares war on Shari Redstone over Viacom merger

    CBS declares war on Shari Redstone over Viacom merger

    A sticking point in merger talks is what role her handpicked lieutenant - Viacom CEO Bob Bakish - would play. Indeed, CBS shareholders appear to be more content without the weight of a relaunched Viacom to worry about.
    Juventus complete double with seventh straight Serie A title

    Juventus complete double with seventh straight Serie A title

    Federico Fazio and Lorenzo Pellegrini both tried their luck while Aleksandar Kolarov's free-kick hit the side netting. Juventus play their final game in Turin at the weekend and Allegri promised a big celebration.
    Turkey recalls US, Israel ambassadors over Gaza slaughter

    Turkey recalls US, Israel ambassadors over Gaza slaughter

    Jared Kushner, Trump's son-in-law and senior adviser, praised the president for following through on his election promise. The new embassy is located in the city's Arnona neighborhood, in the facility that had heretofore served as the U.S.
  • Xiaomi Redmi S2 officially launches in China

    Xiaomi Redmi S2 officially launches in China

    The IDC report is in line with Counterpoint Research's latest report for the same quarter, even though the numbers vary a little. The company has posted a teaser video on its official Twitter handle that hints the launch date of the upcoming will be June 7.
    Boss Key Productions shuts down

    Boss Key Productions shuts down

    After taking some time away from the industry, he returned to co-found Boss Key Productions alongside Arjan Brussee . Boss Key, which as of September employed 65 people , tried to regroup by focusing its effort on " Radical Heights ".
    Small, Autonomous Rotorcraft To Fly On Red Planet — NASA's Mars Helicopter

    Small, Autonomous Rotorcraft To Fly On Red Planet — NASA's Mars Helicopter

    It will carry solar cells to charge up in the light of the sun and a heating mechanism to endure cold nights on the Red Planet. The Mars Helicopter's development began in 2013 at NASA's Jet Propulsion Laboratory (JPL) in California.
  • Leaked images of Samsung's upcoming Galaxy S8 Lite have hit the web

    Leaked images of Samsung's upcoming Galaxy S8 Lite have hit the web

    The battery capacity of this phone is around 3000mAh, the display is 5.8 inches, and it comes with the latest Android 8.0 Oreo. The display of the smartphone is 6.3 inches with super AMOLED Infinity display and a resolution of 1440 x 2960 pixels.
    'Overwatch' anniversary event includes a new Deathmatch map

    'Overwatch' anniversary event includes a new Deathmatch map

    All previously released loot boxes (like the previously released cosmetics) will be available in the anniversary event. The Overwatch two-year anniversary event will introduce the brand-new Deathmatch map, Petra, along with a new mode.
    Lars von Trier's THE HOUSE THAT JACK BUILT Gets a Trailer

    Lars von Trier's THE HOUSE THAT JACK BUILT Gets a Trailer

    IFC Films is releasing The House That Jack Built for the USA , but no release date has been announced at this time. The trailer above isn't cut like your standard movie trailer - there's a lot of long stretches of silence.
  • A New Xbox One Controller Has Leaked

    A New Xbox One Controller Has Leaked

    The design does look a bit odd , but that's because the controller is said to have been designed with accessibility in mind. An accessible Xbox One controller has allegedly been leaked.
    Gov. Bruce Rauner wants to reinstate death penalty to curb violence

    Gov. Bruce Rauner wants to reinstate death penalty to curb violence

    The legislature could also vote to override Rauner's changes and enact the original language with a two-thirds majority vote. The governor also proposes a 72-hour waiting period for the sale of all guns in IL and a ban on bump stocks.
    US To Help North Korea Economy If It Gives Up Nukes

    US To Help North Korea Economy If It Gives Up Nukes

    This year's Shangri-La Dialogue, set for June 1-3, will include a session titled "Deescalating the North Korean crisis". Libyan leader Muammar Ghadafi agreed to surrender his nascent program which was closed down over three months in 2004.
  • We need more time to agree on policies, say Italian populists

    We need more time to agree on policies, say Italian populists

    The north's legions of small, often family-run businesses are the backbone of Italy's most productive region. The M5S is by far Italy's largest single party after winning almost 33 per cent of the vote.
    Fortnite's Infinity War Crossover Event is Ending Tomorrow

    Fortnite's Infinity War Crossover Event is Ending Tomorrow

    Are they easy enough to get done in a few days of grinding? Are you looking forward to these weekly Fortnite challenges? Follow the gallery above and you'll see exactly where that Battle Star should be.
    Scott Arfield's Burnley exit confirmed

    Scott Arfield's Burnley exit confirmed

    New Rangers manager Steven Gerrard hopes to emulate the style of football that Jurgen Klopp has established at Liverpool. Gerrard said of the 29-year-old: "I am delighted to have added Scott Arfield to the squad for next season".
  • Molecule Prevents Common Cold Virus from Hijacking Human Cells

    Molecule Prevents Common Cold Virus from Hijacking Human Cells

    Early studies in the lab are promising but it still needs to be tested in animal and human studies before it could hit the market. The common cold has defied medical science for millennia; it has outfoxed both our immune system and the pharmaceutical industry.
    U.S.  diplomat involved in deadly crash leaves Pakistan

    U.S. diplomat involved in deadly crash leaves Pakistan

    On Saturday, the authorities in Pakistan prevented the Colonel Hall, from flying out of the country. The US Embassy in Islamabad also confirmed that the US diplomat has left Pakistan, the report said.
    YouTube TV Gets The 'Voice Remote' Feature For Some Users

    YouTube TV Gets The 'Voice Remote' Feature For Some Users

    Basically, it can be used to play particular shows, switch to a different channel, pause/play, and fast forward or rewind content. Since it is a server side update, the users will be informed when the voice remote will be available on their Android device.

Breaking News



Recommended

Is Torture Immoral or Not? What Say You, Ms. Haspel?

On Wednesday, Republican members of the Senate Select Committee on Intelligence are expected to unanimously approve Ms. In her confirmation hearing, Haspel said most of the right things. "I'd have them active and ready to go".

South African police confirm explosive device found at mosque

A device resembling a bomb has been removed from a mosque in Verulam, KwaZulu-Natal where three men were stabbed last week . The three attackers escaped in a Hyundai vehicle on the outskirts of the eastern port city.

Submerged: Photos of BC towns battling floods, as new surge predicted

In addition to properties and homes being affected, highways are also feeling the effects of the flooding. River Forecast Centre has upgraded to a flood warning for the Okanagan, Boundary, and Salmon rivers.

Salma Hayek speaks frankly about Harvey Weinstein and #MeToo at Cannes

Hayek also remarked on her allegation of sexual harassment against movie mogul Harvey Weinstein in an op-ed in December. "It is a well-known fact that if you are a woman of color, people believe in you less and believe what you say less.

What You Need to Know About the Massive Egg Recall

The outbreak started with a few hospitalizations in April, but the CDC warns it shows no signs of letting up. The eggs have been sold under a variety of retailers and restaurants, including Walmart and Waffle House.

Ronda Rousey Challenged By WWE Champion For Title Match

Still, after some prodding by Jax and Charlotte Flair, Rousey accepts the challenge before the three laugh their way off camera. Rousey will take on Mickie James in non-televised matches later this week as part of the European tour.

Midfielder Arfield swaps Burnley for Rangers

But the former LA Galaxy star is preparing to bring Rangers back into contention and hope to make an immediate impact at the club. Arfield joined the then League One side Huddersfield in 2010, helping them earn promotion to the Championship two years later.

Kevin Love confident Cavs' shooting will improve in Game 2

The Cavs brought Tristan Thompson - who had struggled throughout the regular season and ended up at the backend of the rotation in the playoffs - back into the starting lineup.

Missing 1-year-old found naked, lying in dirt in OR forest

The sheriff's office said the assault charge stems from an injury Bradley suffered when they believe he was in Blouin's care. The Deschutes County Sheriff's Office said the woman walked away from the vehicle and left the child with Blouin.

Deadline to register to vote in Virginia primaries is May 21

District 5 includes the area south of West Passyunk Avenue west of Broad Street and south of Mifflin Street east of 11th Street. Andre Jacque of De Pere is running against Green Bay businessman Alex Renard for the Republican nomination to the Senate seat.