Even though the CipherMail gateway is not directly vulnerable to EFAIL (see EFAIL: which is vulnerable? PGP, S/MIME or your mail client? for more details), if your email client is configured to automatically download external resources, your email client may leak your decrypted email.
The main issue with the EFAIL “Generic exfiltration” attack is that an encrypted message can be modified by an attacker without being detected. This is a general S/MIME problem and can only be solved by fixing the S/MIME standards.
”... any standard-conforming client will be vulnerable and ... each vendor may cook their own mitigations that may or may not prevent the attacks. Thus, in the long term, it is necessary to update the specification to find and document changes that fix the underlying root causes of the vulnerabilities.”
In our previous blog EFAIL: how to detect you are being attacked? we discussed a possible option to detect that an S/MIME encrypted email was modified.
If an encrypted S/MIME email is modified, multiple blocks of random data will be added to the email. S/MIME emails however, should only contain readable characters. If an email, after decryption, contains non-readable characters, this is an indication that the encrypted message has been tampered with (for more details see EFAIL: how to detect you are being attacked?)
To make sure that CipherMail customers are protected even if a vulnerable email program is used, we have added functionality to the CipherMail Email Encryption Gateway which can detect whether there are non-readable characters in a decrypted message. If non-readable characters are found, a header will be added to the email. An anti spam/virus filter can detect this header and quarantine the email for further inspection. Optionally, decrypting the email can be aborted. The email will then be delivered in encrypted form.
The following two advanced S/MIME options were added: “Check for invalid 7bit chars” and “Abort decrypt on invalid 7bit chars”. If “Check for invalid 7bit chars” is enabled, the decrypted message will be analyzed to check whether all characters are within the acceptable character range for S/MIME (tab, LF, CR, 32-126). If a character is found which is not within the acceptable range, the header “X-Djigzo-Info-SMIME-Illegal-Chars-Found: True” will be added to the email and the following warning message will be printed to the logs:
If “Abort decrypt on invalid 7bit chars” is also enabled, decryption will be aborted and the message will be delivered in encrypted form and the following warning message will be printed to the logs:
The options “Check for invalid 7bit chars” and “Abort decrypt on invalid 7bit chars” are not enabled by default. Although the S/MIME specifications require that email sent over the Internet only use 7bit characters, it may be that some non-conforming S/MIME clients use 8bit characters. Non-conforming S/MIME clients may therefore result in false positives for some emails. The options can be enabled for specific recipients or domains but it's best to enable them on the top level.
Bron: Blog Chipermail
Er zijn nog geen reacties geplaatst
Inloggen voor Mijn Cqure leden
Bestaande leden kunnen inloggen met e-mail en wachtwoord. Heb je via een social media account geregistreerd of deze gekoppeld aan je account? Kies dan het gekoppelde platform om in te loggen.
Login met e-mail en wachtwoord:
Nog geen Mijn Cqure account?
Heb je nog geen account? je kunt je aanmelden door het registratieformulier in te vullen, of door een social media account te koppelen. Het aanmelden is eenvoudig en binnen enkele ogenblikken geregeld.
De voordelen op een rijtje:
- Reacties onmiddelijk zichtbaar in Kennisplatform
- Eenvoudig inschrijven voor events
- Snel inloggen met Facebook of Twitter
- Formulieren aangevuld met jouw profielgegevens