Researchers warn of critical flaw affecting PGP and S/MIME

PGP is leaking your emails in plaintext and there's no known fix

Critical unpatched vulnerabilities in widely-used email encryption tools PGP and S/MIME have been discovered by a team led by Sebastian Schinzel, professor of Computer Security at the Münster University of Applied Sciences.

German researchers have warned those using a popular form of email encryption that serious flaws mean their messages could be decoded by attackers. Service providers have been requested by the EFF to communicate the news to all users and request them to disable all related security plugins including Thunderbird with Enigmail, Apple mail with GPG tools, Outlook with GPG4win.

The use of PGP - short for Pretty Good Privacy - for secure communications has been advocated, among others, by Edward Snowden, who blew the whistle on pervasive electronic surveillance at the U.S. National Security Agency before fleeing to Russian Federation.

For the HTML risk, the researchers advise that OpenPGP and S/MIME users simply disable HTML rendering.

European researchers have found that the popular PGP and S/MIME email encryption standards are vulnerable to being hacked, leading them to urge people to disable and uninstall them immediately.


S/MIME is very similar to PGP except that instead of users defining their own encryption methods and web of trust (how to share their private encryption keys), S/MIME uses predefined encryption standards and public-private keypairs distributed by a trusted authority. The researchers explain that there are two main types: Direct exfiltration attacks (which target weak points in Apple Mail, iOS Mail and Mozilla Thunderbird) and CBC/CFB gadget attacks.

According to encryption software GNU Privacy Guard (GnuPG), the problem comes from email programs that fail to check for decryption errors properly and follow links in emails that included HTML code. "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past".

"The victim's email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker".

The team's leader researcher, Sebastien Schinzel, admitted that: "E-mail is no longer a secure communication medium". Then the emails are changed in a particular way and sent to a victim. The Foundation which has been in communication with the researchers has advised users to "temporarily stop sending and especially reading PGP-encrypted email".

Related News:

  • Atletico Drag UEFA To CAS Over Simeone Ban

    Atletico Drag UEFA To CAS Over Simeone Ban

    Madrid plays Villarreal in the final round of the Liga season before the Champions League final on May 26 in Kiev. In other matches, Valencia won at Girona 1-0, Alaves beat Athletic Bilbao 3-1, and Eibar edged Las Palmas 1-0.
    Sonam Kapoor ties the knot!

    Sonam Kapoor ties the knot!

    Other actresses including Hazel Keech, Sagarika Ghatge and Sonam Kapoor chose to wear red on their wedding day itself. Sonam Kapoor known not just for her powerful on-screen performances but also for her great taste in fashion.
    Siddaramaiah, not a natural choice for CM if Congress wins Karnataka

    Siddaramaiah, not a natural choice for CM if Congress wins Karnataka

    JD (S) chief ministerial candidate HD Kumaraswamy has gone to Singapore, and the reason for his travel could not be ascertained. Congress state President Dr.G Parameshwar has also said that they are open to the idea of Dalit Chief Minister .
  • Drake and Migos Announce Tour and Denver Concert

    Drake and Migos Announce Tour and Denver Concert

    American Express card members can purchase tickets before the general public beginning at 10 a.m. The Aubrey & the Tree Amigos tour will arrive at the Smoothie King Center on September 24.
    ICSE 10th Result 2018 declared at cisce.org, Pass Percentage 98.51

    ICSE 10th Result 2018 declared at cisce.org, Pass Percentage 98.51

    While 49 students got more than 99 percent in the Class 12 exam, 15 students scored more than 99 percent in the Class 10 exam. Out of 73,633 students who appeared for the ISC exam, 71,033 passed and the percentage recorded was 96.56 %.
    'Lost' asteroid to pass closely May 15

    'Lost' asteroid to pass closely May 15

    The asteroid will fly over the earth at a staggering 28,000 miles per hour and it will be between 60 and 130 meters. Our display will update every five seconds", Guy Wells , the founding member of the observatory, told EarthSky .
  • Ryan Reynolds Dresses As Rainbow Unicorn To Sing

    Ryan Reynolds Dresses As Rainbow Unicorn To Sing "Annie" Showtune

    Irish YouTube creator Seán ' Jacksepticeye ' McLoughlin teamed up with Marvel star Ryan Reynolds for a YouTube video. You guys pushed me to my own limits, and I thank you for that". " Deadpool 2 " premieres in theatres on May 18.
    Apple hit with class action suit over MacBook, MacBook Pro keyboard failures

    Apple hit with class action suit over MacBook, MacBook Pro keyboard failures

    According to some customers, Apple not just replaced the unresponsive key, but also had to replace a large part of their computer. Initially, Apple fix centers claimed that the issues with the keyboard were due to dust getting under the keyboard.
    Simpson ties course record, takes 5-shot lead

    Simpson ties course record, takes 5-shot lead

    I think I was ideal inside of 10 to 15 feet today and anywhere inside, which was probably the first time this year. I hit a lot of good, quality shots". "And the ball is flying forever in this humidity".
  • Reliance Jio files complaint against Airtel over Apple Watch eSIM service

    Reliance Jio files complaint against Airtel over Apple Watch eSIM service

    The reason being, the network related infrastructure for pairing the Watch with iPhone isn't set inside India. After the revision of the Airtel prepaid plan 149, the plan now competes with the Reliance Jio Plan 149.
    Who earned how much from Walmart-Flipkart deal

    Who earned how much from Walmart-Flipkart deal

    Walmart founder Sam Walton's grandson, Steuart Walton, is reportedly likely to join Flipkart's board of directors. The agreement will effectively result in transfer of ultimate ownership in Flipkart India to Walmart.
    Motorola Moto C2 and C2 Plus appears in the fresh Renders

    Motorola Moto C2 and C2 Plus appears in the fresh Renders

    Below the camera, where many phones have a fingerprint scanner, there is a static image of the Motorola Batwings logo. Just like the previous leaks , the leaked picture shows all the sides of the smartphone with the sides shot as well.


Most liked

Jos Buttler delivers again, keeps Rajasthan Royals in the hunt
Just like Archer's variations in speed, Royals will hope he can take them from one extreme to another in the league. Mumbai Indians , thanks to their recent good form, are the overwhelming favourites to take this contest.

AMG GT Roadster range expands with 384kW 'S'
The company also offers an AMG carbon-fibre package and an AMG Night package as a few optional packages for the exterior. The model, which is based on the standard GT S, has been slotted between the AMG GT Roadster and the AMG GT C Roadster .

Boston Dynamics SpotMini to Start Selling in 2019
The four-legged robot extends its mechanical arm, turns the door handle and opens it, letting both robots through. It's unclear how much the robots will cost or who will be eligible to purchase them.

Iran's Zarif in Moscow as Russia moves to save nuclear deal
Zarif arrived in Beijing on Sunday for the first stop of his tour, ahead of visiting Moscow and Brussels in the coming days. Tehran said it will preserve the 2015 nuclear deal with Russian Federation despite Washington's decision to withdraw .

Born bishop to preach at royal wedding
Prince Harry and Meghan Markles relationship is transatlantic, and now their wedding ceremony will be too. Welby said on Twitter that he was thrilled the couple selected Curry to give the address.

Ken Early: Manchester City are their own best enemies
The stunning form of Pierre-Emerick Aubameyang since completing a club record move in January does offer a glimmer of hope. I want the best for my friends and he's a friend of mine and I want the best.

Nepal ties scaled 'new heights' after PM Modi's visit, says Nepal's premier
Gehlot alleged that PM Modi's temple visits in Nepal were a violation of the poll code especially on the day Karnataka voted. Both the Congress and the BJP were trading accusations of indulging in unethical practices to woo the voters.

Europe split in confronting the United States sanctions on Iran; Washington isolated
Facing that reality, Le Maire said the European Union should strengthen its own legal arsenal against any such future USA threats. He said France would propose sanctions-blocking measures to the European Commission in the next few days.

Nigerian Mother Sues United Airlines for Kicking Her, Children Out of Plane
When flight attendant couldn't resolve the conflict, Obioma agreed to take his spot to solve the matter, according to the lawsuit. She tried to explain she wanted to take her children to school in Canada but the crew members refused to let her board the plane.

West Bengal panchayat elections: Stray incidents of violence reported in state
In Coochbehar district, North Bengal Development Minister Rabindranath Ghosh allegedly slapped a person outside a polling booth. The polling will begin at 7 a.m. and end at 5 a.m. and counting will take place on May 17, the commission said.

Borussia Dortmund coach Peter Stoeger not staying on
Former Borussia Monchengladbach coach Lucien Favre is tipped to leave French side Nice to replace him. Peter Stoger was a surprising choice by Dortmund but only time will tell if it was the right one.

Xerox ends Fujifilm deal in win for Carl Icahn
Icahn and Deason had opposed Fujifilm's takeover, arguing it undervalued Xerox, and had called for Jacobson's resignation. Xerox ended the planned $6.1 billion deal with Fujifilm Holdings and reached a settlement with the activist investors.

NES Classic Edition Makes A Return To Stores On June 29
Tracking down a Nintendo and purchasing all the games that were included in the NES Classic would cost hundreds of dollars. Nintendo did promise that the mini retro console would be coming back in 2018, and now it has a date.

Mother's Day Music: Andre 3000 Releases Two New Tracks For Mother's Day
The second track, " Look Ma No Hands " is a 17-minute jazz-influenced instrumental with assistance on the piano from James Blake . Titled "Me & My (To Bury Your Parents)" and " Look Ma No Hands ", the singles are part of an EP called Look Ma No Hands .

Pakistan played a role in 26/11 Mumbai terror attacks: Nawaz Sharif
Afghanistans narrative is being accepted, but ours is not. "We must look into it", he said before speaking on the Mumbai attack. The Minister said it proved India's position that the handlers of 26/11 Mumbai terror attack were in Pakistan.