Tuesday, 25 September, 2018

A "serious" flaw has been found in PGP and S/MIME email encryption

PSA PGP and S  MIME are broken and leaking encrypted emails – stop using them right now Uninstall PGP: EFF warns of exploit that may reveal plaintext of encrypted emails
Troy Mann | 14 May, 2018, 19:16

On Tuesday, a team of researchers are planning to release details of a critical vulnerability which they claim could have serious consequences for internet users who use PGP/GPG to encrypt and decrypt their sensitive email communications.

"Securely encrypted email remains an important and suitable means of increasing information security", it said in a statement, adding that the flaws which have been discovered can be remedied through patches and proper use.

The research paper details multiple different approaches that the vulnerabilities can be used in to decrypt S/MIME and OpenPGP encrypted emails in vulnerable clients.

The Electronic Frontier Foundation -which researchers contacted to help them broadcast their message to a broader audience- has published tutorials on how to disable email encryption plugins.

"They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past", researchers said. Obviously, the URL's domain is controlled by the attacker to achieve this; "efail.de" in this example. The researchers explain that there are two main types: Direct exfiltration attacks (which target weak points in Apple Mail, iOS Mail and Mozilla Thunderbird) and CBC/CFB gadget attacks.

Supreme Court strikes down federal law against sports gambling
Supreme issued a ruling this morning that could clear the way for legalized betting on college and professional sports. Trump's administration was on the opposite side of the case, opposing the New Jersey law championed by Christie.


The Monster Hunter movie will star Milla Jovovich
Special effects will be handled by Technicolor company Mr. "He can make a movie look good, is very much into visuals", he added. The film now has a budget of $60 million and will be filmed around South Africa near Cape Town according to Variety .


Xerox ends Fujifilm deal in settlement with Icahn
Toyama Chemical will be combined with its Fujifilm RI Pharma unit effective October 1, Fujifilm said in a statement Monday. The settlement does resolve Deason's litigation against Xerox and its directors in terms of the proxy fight.


In addition to the HTML rendering issue, the EFAIL researchers also posted a more technical exploit of the S/MIME standard specification itself which affects twenty-something clients in addition to Apple's. "There are now no reliable fixes for the vulnerability". This attack relies on a three-part message being sent. This needs to be done in three emails, with the first one opening the HTML tag, the second one containing the encrypted message, and the third closing the HTML tag.

"Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email", EFF said.

Efail attacks work by abusing the active content of HTML emails to access or "exfiltrate" plaintext.

Whilst most email is sent unencrypted, many businesses and people rely on S/MIME and PGP encrypted email communications to talk in private. Long term, comprehensively patching this particular vulnerability will require an update to the underlying email encryption standards. The developer of NeoPG noted on Twitter that "The OpenPGP working group at the IETF, which was on the way to address some of the issues, was closed in November due to lack of progress".

Recommended

Ryan Reynolds Dresses As Rainbow Unicorn To Sing "Annie" Showtune Ryan Reynolds Dresses As Rainbow Unicorn To Sing He made his appearance on the TV show King of Masked Singer , where contestants perform a song while wearing a mask. This was an unbelievable honor for me, you guys pushed me to my own limits and I thank you for that.

Putin says Russian Federation remains Armenia's strategic partner Putin says Russian Federation  remains Armenia's strategic partner After that began in Armenia announced by the opposition leader Nikol Pashinyan is a universal campaign of civil disobedience. Mikser said that it must be observed what the first steps of the new Armenian Prime Minister Nikol Pashinyan are.

'Overwatch' anniversary event includes a new Deathmatch map 'Overwatch' anniversary event includes a new Deathmatch map This version is called the Legendary Edition and will include Legendary, Epic, and Origin skins with 15 skins in total. If you want to spend money, picking up the 50 loot box bundle comes with a bonus of one legendary loot box.

Simon Yates wins to extend lead, Chris Froome fades Simon Yates wins to extend lead, Chris Froome fades Bennett crossed the line in seventh place on the mountain-top finish on Sunday (NZT Monday), 12 seconds behind stage victor Simon Yates .

Final IndyCar GP warmup slowed by smoke, geese Final IndyCar GP warmup slowed by smoke, geese Can the third time be a charm for Will Power? It's the only auto in the first two days of the month to have an engine problem. He gave credit to Power and his crew while also looking ahead to the prize he craves most - another Indianapolis 500 win.

Mercedes-AMG GT S now available as roadster Mercedes-AMG GT S now available as roadster Nappa leather features throughout the cabin and AMG adds its silver chrome trim package as standard. The open-top version of AMG's sports vehicle made its debut in 2016 but only in GT and GT C guises.

Football Field-sized Asteroid To Zip By Earth Football Field-sized Asteroid To Zip By Earth Asteroid 2010 WC9 was first observed on November 30, 2010, by the US-based Catalina Sky Survey in Arizona . On May 8, astronomers spotted the asteroid and gave it a new name before realizing it was 2010 WC9.

Amazon Summer Sale: Best deals on smartphones Amazon Summer Sale: Best deals on smartphones HDFC Bank customers get an addtional cashback of Rs 8,000, which brings down the price tag to the widely advertised Rs 34,999. During the Big Shopping Days sale, the e-commerce giant is selling the Galaxy S8 for a starting price of Rs 37,990.

Pirates Top Giants 6-5 For 5th Straight Win Pirates Top Giants 6-5 For 5th Straight Win A few thoughts and observations about where the Pirates have been over the past few days and where they're headed ... Taillon owns a subpar 4.50 ERA in his three home starts , and the over is 10-4 in the Giants' last 14 games.

Jose Mourinho will not appoint direct replacement for departing assistant Rui Faria Jose Mourinho will not appoint direct replacement for departing assistant Rui Faria Mourinho is expected to have Romelu Lukaku back for the match, though, following a two-week spell on the sidelines since damaging his ankle against Arsenal.

Five tourists killed in Neelum Valley bridge collapse Five tourists killed in Neelum Valley bridge collapse The army's media wing said that the Army personnel shifted four bodies and 11 injured to Muzaffarabad from Shahkot via helicopter. At least 25 local tourists, mostly students, were feared drowned when a bridge collapsed in Neelum Valley in Kashmir Sunday .

Philippines chief justice, Duterte's critic, expelled by Supreme Court colleagues Philippines chief justice, Duterte's critic, expelled by Supreme Court colleagues He said impeachment removes qualified impeachable officers while quo warrantoousts unqualified public officials. President Rodrigo Duterte has called Maria Lourdes Sereno an "enemy" for voting against government proposals.

What we already know about Walmart's plans for Flipkart What we already know about Walmart's plans for Flipkart Japanese internet behemoth Softbank is in discussions to pour in around $3 billion in Paytm Mall. The bank has not chose to sell its stake to Walmart.

Gerrard explains decision to take Rangers role Gerrard explains decision to take Rangers role He said: 'Every fan I have bumped into since the news broke are now officially Rangers fans, too, so that's been a huge boost for me.

Newcastle boss Benitez wants to give Chelsea the blues Newcastle boss Benitez wants to give Chelsea the blues We need to know if everyone has the same ambitions. "We just try to do the right things at the right time". However, he broke his silence by issuing a statement via Newcastle's official website last night.