Re: What’s up Johnny? - DEF CON CON 27/DEF CON 27... · S/MIME PGP S/MIME PGP Windows Thunderbird...

Re: What’s up Johnny?Covert Content Attacks on Email End -To-End Encryption

Jens Müller, Marcus Brinkmann, Damian Poddebniak,Sebastian Schinzel, Jörg Schwenk

Remember EFAIL?

• Last year: EFAIL

Remember EFAIL?

• Last year: EFAIL– Major attack with a logo

Remember EFAIL?

– Novel attack techniques

targeting S/MIME + PGP

Remember EFAIL?

• Today: non-crypto attacks

Remember EFAIL?

• Today: non-crypto attacks– Targeting encryption and digital signatures

Remember EFAIL?

1. Introduction2. Attacks on Encryption3. Attacks on Signatures4. Evaluation5. Mitigation

Overview

Technology's promise

I. “Strong crypto is virtually unbreakable.”

I. “Strong crypto is virtually unbreakable.”II. “Digital signature will prevail. Math wins.”

…claims I. and II. could be bypassed witha single reply to a benign looking email?

What if…

From: alice@good.comTo: johnny@good.comSubject: Important news

Some ASCII text message…

Traditional RFC822 email

-----BEGIN PGP MESSAGE-----…-----END PGP MESSAGE-----

Traditional PGP/Inline

Multipart MIME email

Content-type: text/plain

This is the 2nd part

From: alice@good.comTo: johnny@good.comContent-type: multipart/mixed; boundary="XXX"

--XXX--

multipart/mixed

--XXX--

multipart/mixed

texttext

--XXX--

Content-type: text/html

<b>HTML</b> message…

Content-type: application/pdf

%PDF-1.4 […]

multipart/mixed

pdfhtml

From: alice@good.comTo: johnny@good.comSubject: Important newsContent-Type: application/pkcs7-mime

MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…

S/MIME

OpenPGP (RFC 4880)• Favored by privacy advocates• Web-of-trust (no authorities)

S/MIME (RFC 5751)• Favored by organizations• Multi-root trust-hierarchies

Two competing standards

OpenPGP (RFC 4880)• Favored by privacy advocates• Web-of-trust (no authorities)

S/MIME (RFC 5751)• Favored by organizations• Multi-root trust-hierarchies

Two competing standards

Overview

Attacker model

• Eve has captured ciphertext

Attacker model

• Eve has captured ciphertext• Can modify email structure

Attacker model

• Eve has captured ciphertext• Can modify email structure • Can re-send it to the victim

Attacker model

– Either to recipient or sender

Attacker model

– Either to recipient or sender– Both can decrypt the email

Attacker model

Covert content attack: Decryption oracle

To: johnny@good.com

Decryption oracle

From: alice@good.com

Content-Type: application/pkcs7-mime

To: johnny@good.com

Decryption oracle

From: alice@good.com

To: johnny@good.com

Decryption oracle

From: eve@evil.com

To: johnny@good.com

Decryption oracle

From: eve@evil.com

To: johnny@good.com

Decryption oracle

From: eve@evil.com

Content-type: multipart/mixed; boundary="XXX"

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?

multipart/mixed

???text

--XXX--

Secret message, for Johnny's eyes only…

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?

multipart/mixed

text secret

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?\n\n\n\n\n\n…

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?\n\n\n\n\n\n…

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny? <!--

--XXX--

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny? <!--

--XXX--

Content-ID: <part2>

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny? <img src="cid:part2">

--XXX--

Content-Disposition: attachment

To: johnny@good.com

Decryption oracle

From: eve@evil.com

What's up Johnny?

Overview

Covert content attack: Signing oracle

From: eve@evil.comTo: johnny@good.comContent-type: text/html

What's up Johnny?I hereby declare war.

Signature oracle

What's up Johnny?<div class="covert"> I hereby declare war. </div>

Signature oracle

</style>What's up Johnny?<div class="covert">I hereby declare war.</div>

Signature oracle

hide covertcontent on mobile devices

Signature oracle

@media (min-device-width: 835px) {* {visibility: hidden;}.covert {visibility: visible}}

but show on desktop devices

I'm fine, thanks.

On 01/05/19 09:53, Eve wrote:> What's up Johnny?

Re: What's up Johnny?

I'm fine, thanks.

Reply email sent from Johnny’s mobile phone

I'm fine, thanks.

I hereby declare war.

Signed email received on a desktop device

Conditional rules

• Targeting device type (@media)

Conditional rules

• Targeting device type (@media)• Targeting email client (@supports)

Conditional rules

• Targeting device type (@media)• Targeting email client (@supports)• Targeting user account (@document)

Conditional rules

• Targeting device type (@media)• Targeting email client (@supports)• Targeting user account (@document)

Conditional rules

Overview

OS ClientDecryption Signatures

S/MIME PGP S/MIME PGP

Windows

ThunderbirdOutlookWin. 10 MailWin Live MailThe Bat!PostboxeM Client

KMailEvolutionTrojitáClawsMutt

macOSApple MailMailMateAirmail

iOS Mail App

Android

K-9 MailR2Mail2MailDroidNine

Exchange/OWARoundcubeHorde/IMPMailpile

● Plaintext can be completely hidden

◐ Plaintext merged with attacker-text

○ No vulnerabilities found

– Cryptosystem not available

Decryption oracles

● Covert rules kept in reply message

◐ Covert rules only for received mail

Signature oracles

Windows

Thunderbird ●Outlook ○Win. 10 Mail ○Win Live Mail ○The Bat! ○Postbox ●eM Client ○

KMail ◐Evolution ◐Trojitá ◐Claws ◐Mutt ◐

macOSApple Mail ●MailMate ●Airmail ●

iOS Mail App ●

Android

K-9 Mail –R2Mail2 ○MailDroid ○Nine ○

Exchange/OWA ○Roundcube –Horde/IMP ○Mailpile –

Decryption oracles

Signature oracles

Windows

Thunderbird ● ●Outlook ○ ○Win. 10 Mail ○ –Win Live Mail ○ –The Bat! ○ ○Postbox ● ●eM Client ○ ○

KMail ◐ ◐Evolution ◐ ◐Trojitá ◐ ◐Claws ◐ ◐Mutt ◐ ◐

macOSApple Mail ● ●MailMate ● ●Airmail ● ●

iOS Mail App ● –

Android

K-9 Mail – ○R2Mail2 ○ ●MailDroid ○ ○Nine ○ –

Exchange/OWA ○ –Roundcube – ◐Horde/IMP ○ ○Mailpile – ○

Decryption oracles

Signature oracles

Windows

Thunderbird ● ● ●Outlook ○ ○ ◐Win. 10 Mail ○ – ◐Win Live Mail ○ – ●The Bat! ○ ○ ○Postbox ● ● ●eM Client ○ ○ ◐

KMail ◐ ◐ ○Evolution ◐ ◐ ◐Trojitá ◐ ◐ ◐Claws ◐ ◐ ○Mutt ◐ ◐ ○

macOSApple Mail ● ● ◐MailMate ● ● ●Airmail ● ● ●

iOS Mail App ● – ●

Android

K-9 Mail – ○ –R2Mail2 ○ ● ◐MailDroid ○ ○ ●Nine ○ – ●

Exchange/OWA ○ – ●Roundcube – ◐ ◐Horde/IMP ○ ○ ◐Mailpile – ○ –

Decryption oracles

Signature oracles

Windows

Thunderbird ● ● ● ●Outlook ○ ○ ◐ ◐Win. 10 Mail ○ – ◐ –Win Live Mail ○ – ● –The Bat! ○ ○ ○ ○Postbox ● ● ● ●eM Client ○ ○ ◐ ◐

KMail ◐ ◐ ○ ○Evolution ◐ ◐ ◐ ◐Trojitá ◐ ◐ ◐ ◐Claws ◐ ◐ ○ ○Mutt ◐ ◐ ○ ○

macOSApple Mail ● ● ◐ ◐MailMate ● ● ● ●Airmail ● ● ● ●

iOS Mail App ● – ● –

Android

K-9 Mail – ○ – ●R2Mail2 ○ ● ◐ ◐MailDroid ○ ○ ● ●Nine ○ – ● –

Exchange/OWA ○ – ● –Roundcube – ◐ ◐ ◐Horde/IMP ○ ○ ◐ ◐Mailpile – ○ – ○

Decryption oracles

Signature oracles

Windows

Thunderbird ● ● ● ●Outlook ○ ○ ◐ ◐Win. 10 Mail ○ – ◐ –Win Live Mail ○ – ● –The Bat! ○ ○ ○ ○Postbox ● ● ● ●eM Client ○ ○ ◐ ◐

KMail ◐ ◐ ○ ○Evolution ◐ ◐ ◐ ◐Trojitá ◐ ◐ ◐ ◐Claws ◐ ◐ ○ ○Mutt ◐ ◐ ○ ○

macOSApple Mail ● ● ◐ ◐MailMate ● ● ● ●Airmail ● ● ● ●

iOS Mail App ● – ● –

Android

K-9 Mail – ○ – ●R2Mail2 ○ ● ◐ ◐MailDroid ○ ○ ● ●Nine ○ – ● –

Exchange/OWA ○ – ● –Roundcube – ◐ ◐ ◐Horde/IMP ○ ○ ◐ ◐Mailpile – ○ – ○

Decryption oracles

Signature oracles

Overview

Decryption oracles

• Accepting ASCII text only

Decryption oracles

• Accepting ASCII text only

Decryption oracles

• Accepting ASCII text only• Enforcing digital signatures

Decryption oracles

• Accepting ASCII text only• Enforcing digital signatures

Decryption oracles

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption

Decryption oracles

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption

Decryption oracles

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption• All-or-Nothing Encryption

Decryption oracles

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption• All-or-Nothing Encryption

Decryption oracles

Root causes: long-term keys +ciphertext usage out-of-context

Signing oracles

• Dropping CSS Support

Signing oracles

• Dropping CSS Support

Signing oracles

• Dropping CSS Support• Only ASCII Text in replies

Signing oracles

• Dropping CSS Support• Only ASCII Text in replies• Remove styles from replies

Signing oracles

Conclusion

• Crypto is not enough, bypasses exist

Conclusion

• Crypto is not enough, bypasses exist• 22 of 24 tested clients are vulnerable

Conclusion

• Crypto is not enough, bypasses exist• 22 of 24 tested clients are vulnerable• Building security on top of email is hard

Conclusion

• Crypto is not enough, bypasses exist• 22 of 24 tested clients are vulnerable• Building security on top of email is hard

Conclusion

Thank you! Questions?Exploits: github.com/RUB-NDS/Covert-Content-Attacks

HTML and CSS support in various email clients

Proprietary conditional features

Blinding options

Re: What’s up Johnny? - DEF CON CON 27/DEF CON 27... · S/MIME PGP S/MIME PGP Windows Thunderbird...

Documents

Email Securitypgut001/tutorial/T5_Email.pdfEmail Security “Why do we have to hide from the police, Daddy?” “Because we use PGP, son. They use S/MIME” Email Security Problems

PGP Secure Email (S/MIME) Guide for External Organisations...4.2 S/MIME S/MIME (Secure / Multipurpose Internet Mail Extensions) is an internet standard that supports the encryption

ANNUAL SYMPOSIUM ON INFORMATION ASSURANCE & …sonia/content/Fry...sending end-to-end secure email: PGP [7] and S/MIME [4]. While PGP was developed first (in 1993), today the most

Chapter 6 IP Security. We have considered some application specific security mechanisms in last chapter eg. S/MIME, PGP, Kerberos however there are security

PGP Public Key Import PGP Data Encryption

Mail encryption - Secure Webmail guide€¦ · You have a self-signed S/MIME certificate or PGP key and want to use this for encrypted email - correspondence between Raiffeisen and

Server-based email encryption signature verification (validation with S/MIME only). iQ.Suite Crypt Pro supports the PGP/GnuPG encryption standard for Windows, Linux, AIX and Sun Solaris

Lecture 07 PGP and S/MIME Supakorn Kungpisdan, Ph.D. supakorn@mut.ac.th 1ITEC4621 Network Security

Secure Working in Insecure Environments Thanks to Unique ... · Their security features include for example email encryp-tion (PGP, S/MIME), secure server administration (SSH) and

SSL & Digital Certificates by GlobalSign · The main rival to S/MIME is PGP, the most common implementation of which is OpenPGP. PGP differs by not utilising certificates for public

Performance - 2.1 Developement of Mime (Mime PowerPoint)

PGP Universal 2 - dragon-networks.comPGP Desktop 及びS/MIME等の証明書ユーザは、公開鍵をPGP Universalに登録することにより、以後の通信はPGP Universalとの

Sécurité des RO Partie 5 : S-MIME, PGP, Sbox, OTP Présentationirt.enseeiht.fr/anas/cours/protocoles.pdf · Transport : SSL, TLS Liaison : CHAP, PAP Réseau : authentification IP

X.509 Topics PGP S/MIME Kerberos. Directory Authentication Framework X.509 is part of the ISO X.500 directory standard. used by S/MIME, SSL, IPSec, and

Nivel de aplicación: Web I · PDF file · 2010-05-12Extensiónes MIME MIME introduce 5 nuevos campos en un mensaje MIME-Version: indica la versión MIME utilizada Ejemplo: “MIME-Version:

3. インターネットのアプリケーション - UTokyo …...– PGP, S/MIME 11 3.2 マルチメディアデータ形式 12 MIME (Multipurpose Internet Mail Extensions) •ASCII文字以外のデータを送るための仕

Exﬁltration Channels Channels Efail: Breaking S/MIME and ... · 2.2 Cryptographic basics In the email context, both S/MIME and PGP use hybrid encryption, in which the sender generates

Chapter 5 Electronic mail security PGP & S/MIME 1 Khushbu Shah

1 IP Security. 2 IP Security Overview We have considered some application specific security mechanisms –eg. S/MIME, PGP, Kerberos, SSL/HTTPS However there

Vorlesung 2: 9.12weber-vorlesung.de/Datensicherheit_02.pdf · wird zum Beispiel bei PGP und S/MIME für E-Mail-Verschlüsselung verwendet. Datensicherheit 2-16 9.12.2019 Heiko Weber