Critical vulnerabilities in PGP/GPG and S/MIME email encryption, warn researchers

PGP is leaking your emails in plaintext and there's no known fix

According to security researcher and professor Sebastian Schninzel of FH M√ľnster, PGP and S/MIME email encryption contains a flaw that allows for the plaintext form to be recovered. The attacker would have to have access to the encrypted emails to begin with, meaning that the victim's account would need to be compromised as a starting point. In this scenario, the researchers wrote that the attacker already had gained access to end-to-end encrypted emails.

Matthew Green, assistant professor at the Department of Computer Science at Johns Hopkins University and crypto-expert broke down the attack in simpler terms: "In a nutshell, if I intercept an encrypted email sent to you, I can modify that email into a new encrypted email that contains custom HTML", he tweeted. The attacker would then have to get the sender or one of the receivers of the previously obtained message to open a new attacker-sent email.

More details are to be published by the researchers on May 15 who recommend not using the two encryption tools until they are fixed.

The security flaws that have been discovered could potentially leak the contents of the encrypted messages you send and receive via email when signed with PGP or S/MIME encryption methods. In contrast, mainstream email clients simply process and store your messages using plain text.

He argued it wasn't really a vulnerability in the OpenPGP system but rather in email programs that had been designed without appropriate safeguards. And that person's email client decrypts the email and loads external content, "thus exfiltrating the plaintext to the attacker". "There is a real attack that can be exploited by people that allows them to decrypt a lot of encrypted email".

EFF's recommendation: If you use PGP or S/MIME, disable them, and uninstall the tools that decrypt them.

United States opens embassy in Jerusalem as Gaza erupts in violence, 55 dead
She said Jerusalem was an internationally recognised disputed territory and a "fair division" was the only hope of peace. Netanyahu said that "under any peace agreement you could possibly imagine, Jerusalem will remain Israel's capital".

Although no fix is presently available, the researchers advise that email decryption take place in a separate program, as well as disabling HTML rendering from your email client as a mitigation step.

If you're using encrypted email (PGP and S/MIME) to exchange sensitive data with others, you should consider other alternatives until you hear they're safe again.

Schinzel also urged users via Twitter to visit the blog posts by the EFF, which includes detailed step-by-step guides on how to disable PGP in Outlook, Apple Mail, and Thunderbird.

However, Werner Koch, free software developer and author of the GNU Privacy Guard, posted information on Monday which claims the warnings from EFF are "pretty overblown".

Nobody knows. But we do know that end-to-end encrypted emails aren't as secure as we thought they were, and that means we'll have to continue to be careful about how we communicate.

Related news:

Hot News

isis-killer-beheading-video-story-top Driver: Tesla's autopilot engaged during Utah crash
May 15, 2018 - 12:41
The Tesla driver suffered a broken ankle and there were no injuries reported for the driver of the truck, according to CNBC . At Waymo , Matthew Schwall will be responsible to handle auto safety issues and he joined the firm from last Monday.

isis-killer-beheading-video-story-top North Korea to become nuclear weapons state: Former diplomat
May 15, 2018 - 12:09
But Pyongyang had a long history of making overtures that ultimately came to nothing, he warned. Relations between China and North Korea have drastically improved recently.

isis-killer-beheading-video-story-top United Nations chief welcomes North Korea's closure of nuke test site
May 15, 2018 - 12:06
Located in mountainous terrain in the northeast of the country, Punggye-ri is less than 100 miles (160 kilometers) from China. Pompeo, who has met twice with the North Korean leader to discuss the summit, said he was "convinced" Kim shared U.S. goals.

isis-killer-beheading-video-story-top 'Religious bigot' wrong man to give Jerusalem embassy prayer - Romney
May 15, 2018 - 12:03
The inaugural event itself spurred an outbreak of protests among Palestinians in Gaza, about 40 miles away from Jerusalem. Hagee said the new embassy made a clear statement: "Let every Islamic terrorist hear this message: 'Israel lives'".

isis-killer-beheading-video-story-top Microsoft Rumored To Work On A New Xbox One Controller
May 15, 2018 - 12:02
If this leak proves true, the accessibility-minded controller option could open up Xbox One games to an even wider audience. This isn't the first time Microsoft would have designed a controller that works well for gamers with physical limitations.

isis-killer-beheading-video-story-top McCutchen returns to PNC Park as Pirates host Giants
May 15, 2018 - 11:59
Now they head to pitcher-friendly PNC Park and will face Taillon, who has shut down most of the opponents that he's faced in 2018. The three-run blast was the fifth hit by the Giants this season after the club hit just seven all of a year ago .

isis-killer-beheading-video-story-top US Diplomat Involved In Fatal Road Accident Departs Pakistan
May 15, 2018 - 11:55
Police have also handed over all records related to Colonel Hall to USA officials. The spokesman did not identify the USA diplomat and provided no further details.

isis-killer-beheading-video-story-top Egypt condemns terror attack on Indonesian police station
May 15, 2018 - 11:54
The church attacks occurred within minutes of each other, according to Surabaya police spokesman Frans Barung Mangera. The country launched a crackdown on militants following bombings by radical is Bali in 2002 killed 202 people.

isis-killer-beheading-video-story-top Former PM Najib, wife banned from leaving Malaysia
May 15, 2018 - 11:51
On Thursday, Mahathir Mohamad was sworn in as Malaysia's new prime minister, becoming the world's oldest elected leader at 92. But the new prime minister said on Sunday: "Even though we support freedom of press and freedom of speech, there are limits".

isis-killer-beheading-video-story-top Melania Trump's Emergency Kidney Procedure Explained
May 15, 2018 - 11:49
The East Wing keeping her medical condition private until after the procedure was nothing unusual, the Post said. The Internet has gone wild with speculation that Melania Trump is miserable in her role as First Lady.

isis-killer-beheading-video-story-top Nanny who killed 2 children gets life in prison without parole
May 15, 2018 - 11:48
In 2012, in the aftermath of the killings , the Krims founded the Lulu & Leo Fund, which supports creativity in schools. Prosecutors say Ortega knew what she was doing and understood "each stab, each slash" as she slaughtered the youngsters.

isis-killer-beheading-video-story-top Planned Iran sanctions, tight supply send oil to new multi-year high
May 15, 2018 - 11:46
OPEC expects non-OPEC supply to expand by 1.72 million bpd this year, which is higher than the growth in global demand. The number of rigs drilling for oil in the US rose by 10 last week to 844 rigs, the highest in more than three years.

isis-killer-beheading-video-story-top Juve win seventh successive Serie A title
May 15, 2018 - 11:39
Meanwhile, Atalanta held AC Milan to a 1-1 draw, threatening the latter's hopes of finishing Italian league play in a Europa League position.

isis-killer-beheading-video-story-top Massive asteroid to brush past Earth: Watch closest encounter in 300 years
May 15, 2018 - 11:31
Just last month, astronomers spotted a slightly smaller asteroid for the first time just before it buzzed by us . An asteroid the size of the Statue of Liberty will pass by the Earth , narrowly missing us.

isis-killer-beheading-video-story-top Dragon float in Disney's Festival of Fantasy Parade catches fire
May 15, 2018 - 11:30
A dragon float from the movie Maleficent caught fire at Disney World's Magic Kingdom Friday afternoon. No visitors or employees were hurt, and the local fire service is investigating the cause.