Researchers warn of critical flaw affecting PGP and S/MIME

PGP is leaking your emails in plaintext and there's no known fix

Critical unpatched vulnerabilities in widely-used email encryption tools PGP and S/MIME have been discovered by a team led by Sebastian Schinzel, professor of Computer Security at the Münster University of Applied Sciences.

German researchers have warned those using a popular form of email encryption that serious flaws mean their messages could be decoded by attackers. Service providers have been requested by the EFF to communicate the news to all users and request them to disable all related security plugins including Thunderbird with Enigmail, Apple mail with GPG tools, Outlook with GPG4win.

The use of PGP - short for Pretty Good Privacy - for secure communications has been advocated, among others, by Edward Snowden, who blew the whistle on pervasive electronic surveillance at the U.S. National Security Agency before fleeing to Russian Federation.

For the HTML risk, the researchers advise that OpenPGP and S/MIME users simply disable HTML rendering.

European researchers have found that the popular PGP and S/MIME email encryption standards are vulnerable to being hacked, leading them to urge people to disable and uninstall them immediately.


S/MIME is very similar to PGP except that instead of users defining their own encryption methods and web of trust (how to share their private encryption keys), S/MIME uses predefined encryption standards and public-private keypairs distributed by a trusted authority. The researchers explain that there are two main types: Direct exfiltration attacks (which target weak points in Apple Mail, iOS Mail and Mozilla Thunderbird) and CBC/CFB gadget attacks.

According to encryption software GNU Privacy Guard (GnuPG), the problem comes from email programs that fail to check for decryption errors properly and follow links in emails that included HTML code. "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past".

"The victim's email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker".

The team's leader researcher, Sebastien Schinzel, admitted that: "E-mail is no longer a secure communication medium". Then the emails are changed in a particular way and sent to a victim. The Foundation which has been in communication with the researchers has advised users to "temporarily stop sending and especially reading PGP-encrypted email".

Related News:



Most liked

Drake and Migos Announce Tour and Denver Concert
American Express card members can purchase tickets before the general public beginning at 10 a.m. The Aubrey & the Tree Amigos tour will arrive at the Smoothie King Center on September 24.

Controversial US pastors take part in Jerusalem embassy opening
I'm going to be thanking God for the strong leadership of Benjamin Netanyahu, who is absolutely determined to protect Israel. Not deterred, an unimpressed Jeffress responded to essentially say there's nothing to see here.

Overwatch anniversary event date and new Junkrat skin revealed
New items include eight Legendary skins and three Epic skins, and additional dance emotes for Doomfist, Moira, and Brigitte. If you decide to buy the 50 Loot Box Bundle, you'll receive an additional Legendary Anniversary Loot Box for free.

ICSE 10th Result 2018 declared at cisce.org, Pass Percentage 98.51
While 49 students got more than 99 percent in the Class 12 exam, 15 students scored more than 99 percent in the Class 10 exam. Out of 73,633 students who appeared for the ISC exam, 71,033 passed and the percentage recorded was 96.56 %.

Ryan Reynolds Dresses As Rainbow Unicorn To Sing "Annie" Showtune
Irish YouTube creator Seán ' Jacksepticeye ' McLoughlin teamed up with Marvel star Ryan Reynolds for a YouTube video. You guys pushed me to my own limits, and I thank you for that". " Deadpool 2 " premieres in theatres on May 18.

SCOTUS Paves Way For Legalized Sports Betting Outside Nevada
It exempted Nevada , where sports betting has always been legal, along with sports lotteries in Delaware, Montana and Oregon. West Virginia and 17 other states, and the governors of three more, sided with New Jersey in the case.

Sonam Kapoor ties the knot!
Other actresses including Hazel Keech, Sagarika Ghatge and Sonam Kapoor chose to wear red on their wedding day itself. Sonam Kapoor known not just for her powerful on-screen performances but also for her great taste in fashion.

Ken Early: Manchester City are their own best enemies
The stunning form of Pierre-Emerick Aubameyang since completing a club record move in January does offer a glimmer of hope. I want the best for my friends and he's a friend of mine and I want the best.

Nepal ties scaled 'new heights' after PM Modi's visit, says Nepal's premier
Gehlot alleged that PM Modi's temple visits in Nepal were a violation of the poll code especially on the day Karnataka voted. Both the Congress and the BJP were trading accusations of indulging in unethical practices to woo the voters.

Who earned how much from Walmart-Flipkart deal
Walmart founder Sam Walton's grandson, Steuart Walton, is reportedly likely to join Flipkart's board of directors. The agreement will effectively result in transfer of ultimate ownership in Flipkart India to Walmart.

Hernandez, Hundley lead Giants to 5-0 win over Pirates
Nova (2-3) gave up four runs and eight hits in 5 2/3 innings and is 0-2 in five starts since beating Miami on April 15. Hundley sent reliever Richard Rodriguez's first pitch over the wall in left for a three-run homer and a 5-0 lead.

Mother's Day Music: Andre 3000 Releases Two New Tracks For Mother's Day
The second track, " Look Ma No Hands " is a 17-minute jazz-influenced instrumental with assistance on the piano from James Blake . Titled "Me & My (To Bury Your Parents)" and " Look Ma No Hands ", the singles are part of an EP called Look Ma No Hands .

Mike Ashley wants Rafael Benitez to remain in charge at Newcastle
He said: "I think this week, maybe there will be another conversation and we will see where we are for the next week". The billionaire - who wants United's manager to sign a new deal - made a similar pledge previous year .

Simpson ties course record, takes 5-shot lead
I think I was ideal inside of 10 to 15 feet today and anywhere inside, which was probably the first time this year. I hit a lot of good, quality shots". "And the ball is flying forever in this humidity".

Flipkart's Big Shopping Days sale: Huge discounts, 100% cashback for 4 days
Samsung Galaxy S8: Discount of Rs 12,000 The Samsung Galaxy S8 is also available a pretty good discount during the four-day sale. Redmi 5 with 3GB RAM and 32GB storage is priced at Rs 8,999 during the sale with Amazon adding another Rs 8,001 off on exchange.