EFAIL: Your email app could be exposing your encrypted messages

Computer encryption

Electronic Frontier Foundation (EFF) in a separate blog post recommended users to immediately disable email tools that automatically decrypt PGP-encrypted email. The flaw found in PGP/GPG and S/MIME email encryption software potentially lets others view sent messages in plain text.

University researchers from Münster and Bochum in Germany, as well as Leuven in Belgium, discovered the flaws in the encryption methods that can be used with popular email applications such as Microsoft Outlook, Apple Mail and Enigmail for Thunderbird, which all offer to decrypt emails on the fly. The idea is that attackers shouldn't be able to read your messages even if they intercept them or somehow gain access to your accounts.

Prior to the leak, Schnizel stated that there were "no reliable fixes", and recommended that affected users disable breached encryption software.

Homeland Security Denies Report That Secretary Drafted Resignation Letter
Trump reportedly railed against Nielsen on Wednesday, saying that she failed to adequately secure the U.S. border . Administration officials spoke on the condition of anonymity to provide a candid account of the private meeting.


PGP, which stands for "pretty good protection", and S/MIME have always been standards for end-to-end email encryption.

Of course, if you recognise the need to secure encrypt your communications you probably also understand that resorting to sending and receiving unencrypted email is far from an acceptable solution. Within hours, the researchers published the paper, which is titled Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels. The victim's email client decrypts the email and loads any external content (added by the attacker), thus exfiltrating the plaintext to the attacker.

"EFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs".

PENCE TO MUELLER: It's Time to 'WRAP IT UP'
Trump on Thursday talked up the economy and his accomplishments, telling a rowdy audience that the "great news keeps rolling in". Pence maintained, like Trump, that the administration is fully cooperating with the investigation and will continue to do so.


This turning into another Heartbleed is unlikely given that this level of encryption is, for most, belt and braces - nobody cares what you had for dinner - but for those who rely on PGP for genuine confidentiality?

Another way would be to use authenticated encryption via tools such as OpenPGP, he argued.

"The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim", the EFF's spokesperson explained.

Severe storms possible Thursday night — WEATHER ALERT DAY
A moderate rip current risk was in effect through Wednesday night, according to the weather service in Newport-Morehead City. We have our first true chance of severe storms today, as a Slight Risk of severe weather has been issued for the region.


UPDATE 2: Because some researchers started disclosing details about the vulnerability ahead of schedule, the efail.de website is now live, along with the research paper, both containing more info on the EFAIL vulnerability. There are other methods that could be used to attack the information, but these backchannels are more hard to exploit. However, the researchers have confirmed the exploitable vulnerabilities only exist for email users.

Related news:

Hot News

isis-killer-beheading-video-story-top Sen. Paul on Sen. McCain, their opposition against Central Intelligence Agency director nominee
May 14, 2018 - 20:46
Mr Trump said Democrats like Donnelly say one thing, "and then they go to Washington and vote for the radical, liberal agenda". John McCain has also called on the Senate to reject Haspel for refusing to acknowledge "torture's immorality".

isis-killer-beheading-video-story-top OnePlus 6 Fast AF Sale
May 14, 2018 - 20:46
Just a few days before OnePlus introduces the new OnePlus 6 , a massive leak has revealed the price of the upcoming flagship. Despite being available nearly exclusively online, demand for OnePlus smartphones is strong with each new release.

isis-killer-beheading-video-story-top Controversial pro-Trump pastor offers blessing at Jerusalem embassy opening
May 14, 2018 - 20:45
Jeffress said he would "be thanking God for the strong leadership of Benjamin Netanyahu, who is absolutely determined to protect Israel".

isis-killer-beheading-video-story-top US Jerusalem embassy opening starts long process
May 14, 2018 - 20:44
Since weekly border marches began in March, scores of Palestinian protesters have been killed and more than 2,300 wounded. Palestinian President Mahmoud Abbas cut ties with the Trump administration and declared it unfit to mediate peace talks.

isis-killer-beheading-video-story-top Teen arrested after student shot at LA-area high school
May 13, 2018 - 00:24
The school is on lockdown, students were told to shelter in place and parents were told to stay away from the area. Millen Intermediate, Cottonwood Elementary and Ocotillo Elementary - were on lockdown, employees there said.

isis-killer-beheading-video-story-top Giuliani resigns from law firm due to 'pressing demands' of Mueller probe
May 13, 2018 - 00:20
But he added, Giuliani now recognizes that the new task is "all consuming" and "lasting longer than initially anticipated". In his new role as firefighter-in-chief for the president, it seems likely Giuliani will face no shortage of flames.

isis-killer-beheading-video-story-top Hamilton triumphs in tense battle for Spanish GP pole
May 13, 2018 - 00:16
Raikkonen will start fourth in an all-Ferrari second row ahead of the two Red Bulls of Max Verstappen and Daniel Ricciardo. McLaren's Fernando Alonso and Renault's Carlos Sainz Jr split the two Haas's, qualifying eighth and ninth respectively.

isis-killer-beheading-video-story-top Arvind Kejriwal's kin arrested in PWD scam
May 13, 2018 - 00:07
He also said that the IIT- Roorkee had done a third-party audit of the concerned drainage system project and submitted a report. He said the contract in question was given to Bansal's company in Januray, 2015 while Kejriwal came to power a month later.

isis-killer-beheading-video-story-top AT&T CEO: We made 'big mistake' hiring Cohen, chief lobbyist out
May 13, 2018 - 00:04
The company is defending its merger with Time Warner in federal court against the Justice Department's efforts to block the deal. The company said it was contacted by Mueller's office in November , though now considers its role in that inquiry closed.

isis-killer-beheading-video-story-top Spotify Removes R. Kelly From Its Playlists After Sexual Misconduct Allegations
May 11, 2018 - 05:13
Spotify has announced a new policy on hate content and hateful conduct and says Kelly's alleged behavior falls under that policy. Just last week, Hollywood's Time's Up Movement launched a campaign entitled #MuteRKelly in an effort to silence the singer.

isis-killer-beheading-video-story-top SpaceX calls off launch of its new rocket at the last minute
May 11, 2018 - 05:13
Company insiders believe that SpaceX wants NASA to use the rocket to carry astronauts to and from the International Space Station. At the time of this update , the rescheduled time for liftoff was aimed at 5:47 PM Eastern Time (that's 21:47 GMT).

isis-killer-beheading-video-story-top A Former Top Chinese Official Gets Life Term for Corruption
May 11, 2018 - 05:12
One of the most powerful men in all of China presently, Jinping rose to fame due to his anti-corruption stance. It has not been possible to reach Sun for comment, and it is unclear whether he has a lawyer.

isis-killer-beheading-video-story-top Gina Haspel is unfit for any job in government
May 11, 2018 - 05:12
But Sanders also said she had not recently discussed with Trump the question of whether torture is effective. Feinstein at least has the potential to be more reasonable when it comes to nominees named by Republicans.

isis-killer-beheading-video-story-top Fans upset after Fox cancels "Brooklyn Nine-Nine"
May 11, 2018 - 05:11
The final episode of the fifth and final season will air later this month, the network said. But Brooklyn Nine-Nine, like Mindy , is a Universal Television production.

isis-killer-beheading-video-story-top Parents asked to prepare students for the Wireless Public Alert System test
May 11, 2018 - 05:06
The system is still scheduled for the rest of the country this week, with tests planned for BC and AB on Wednesday afternoon. But Blanchet said those alerts have been in place for app users since 2015, and that Monday's wireless testing is different.