Subject: [dmarc-ietf] Too bad that the EFAIL victims never heard of DKIM/DMARC

From: Kurt Andersen <[email-masked]>
Date: Tue, 15 May 2018 07:15:07 -0700

Manipulating MIME structures in email messages to expose the encrypted
content: https://efail.de/

--Kurt

---

From: Steve Atkins <[email-masked]>
Date: Tue, 15 May 2018 07:39:18 -0700

> On May 15, 2018, at 7:15 AM, Kurt Andersen <[email-masked]> wrote:
> 
> Manipulating MIME structures in email messages to expose the encrypted content: https://efail.de/

While I'd agree that the whole efail thing is a little over-hyped, I don't see where in the exploit
process having DKIM or DMARC would help in the slightest.

Cheers,
  Steve

---

From: Grant Taylor <[email-masked]>
Date: Tue, 15 May 2018 08:53:35 -0600

> content: https://efail.de/

DKIM will not help protect against #Efail.

Efail works by copying ciphertext into a new message and arranging for 
the client to decrypt it.  Said new message is devoid of any association 
with DKIM.

-- 
Grant. . . .
unix || die

---

From: "John Levine" <[email-masked]>
Date: 15 May 2018 12:09:31 -0400

In article <[email-masked]> you write:
>-=-=-=-=-=-

I suppose, for the 10 seconds from the time the message is created
until the attacker's MTA signs it on the way out.  The bad guy can put
a return address he controls on the malicious message and make the
whole thing DMARC compliant.

R's,
John

---

From: Paul Rock <[email-masked]>
Date: Tue, 15 May 2018 12:33:04 -0400

If someone tries some sort of man in the middle inline injection attack to
pull this off, sure, I can see DKIM catching that. But the really really
nasty bit is the assumption is that you (the target) are running an email
client that automatically decrypts any inbound message and render's the
HTML for display irregardless of the message source. I (the bad guy) grab
an original encrypted message bound for you, (because I see it transit the
network, or get access to your message store, or many other reasons) pull
out the message body with the cyphertext, create a new multi-part (assuming
we're talking about the direct attack) and send it to you as mailfrom:
[email-masked], dkim-domain: badplacehere.xyz, from: "PERSON YOU
KNOW, FOR REALZ" <[email-masked]>. You're tapping next next next
in your email client, the client loads my message, sends me the decrypted
text, and you scratch your head wondering why you got two copies of the
message. Or even better, I setup my first body to just be something like
innocent like "Hey, have any updates?" and then change the font size to
zero, or text color to white or something like that... so you wouldn't even
see the original message rendered.

On Tue, May 15, 2018 at 12:09 PM, John Levine <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

-- 
PAUL ROCK
*Sr Software Dev Engineer* | AOL Mail
P: 703-265-5734 | C: 703-980-8380
AIM: paulsrock
22070 Broderick Dr.| Dulles, VA | 20166-9305

---

From: Grant Taylor <[email-masked]>
Date: Tue, 15 May 2018 10:37:14 -0600

On 05/15/2018 10:09 AM, John Levine wrote:
> I suppose, for the 10 seconds from the time the message is created until 
> the attacker's MTA signs it on the way out.  The bad guy can put a return 
> address he controls on the malicious message and make the whole thing 
> DMARC compliant.

There is a much larger attack window than that.

If an attacker gets a copy of an encrypted message, any where at any 
time, they can craft a new completely unrelated message that includes 
the ciphertext and coerce the receiving MUA to decrypt it and exfiltrate 
the cleartext.

This is not a timed / coordinated attack.

An attacker could literally extract something form an archive years 
later and (potentially) get you to decrypt and exfiltrate it.

I say potentially because there is a dependency on the recipient's MUA 
still having the ability to decrypt old encrypted messages.  I.e. cert 
rotation.

-- 
Grant. . . .
unix || die

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Tue, 15 May 2018 09:46:49 -0700

On Tue, May 15, 2018 at 9:37 AM, Grant Taylor <
gtaylor=[email-masked]> wrote:

>> address he controls on the malicious message and make the whole thing DMARC
>> compliant.
>>
>
> If an attacker gets a copy of an encrypted message, any where at any time,
> they can craft a new completely unrelated message that includes the
> ciphertext and coerce the receiving MUA to decrypt it and exfiltrate the
> cleartext.
>

People who run their GUI MUA to auto-decrypt and display undefanged HTML
probably also run that client as root so the exploit is really quite a lot
more risky than even the hype has made out.

--Kurt

---

From: Grant Taylor <[email-masked]>
Date: Tue, 15 May 2018 11:02:20 -0600

On 05/15/2018 10:33 AM, Paul Rock wrote:
> You're tapping next next next in your email client, the client loads my 
> message, sends me the decrypted text, and you scratch your head 
> wondering why you got two copies of the message.

The recipient shouldn't see the second copy of the decrypted message.  I 
say this because the decrypted copy (as in text) is used as part of a 
URL source, and not actually displayed to the recipient.

> Or even better, I setup my first body to just be something like innocent 
> like "Hey, have any updates?" and then change the font size to zero, 
> or text color to white or something like that... so you wouldn't even 

You could put a generic place holder "Hay, have any updates?" in the 
message, but you don't need to try to hide anything because it's part of 
a src="…" that is not rendered.

What would be funny is for the "Hay, have any updates?" to be the image 
returned from the aforementioned <img src="…"> tag.  }:-)

-- 
Grant. . . .
unix || die

---

From: Grant Taylor <[email-masked]>
Date: Tue, 15 May 2018 11:04:59 -0600

On 05/15/2018 10:46 AM, Kurt Andersen (b) wrote:
> probably also run that client as root so the exploit is really quite a 
> lot more risky than even the hype has made out.

I doubt that.

I'm sure that some of the people that do run their MUA as root / 
administrator will also auto-decrypt and render HTML.

But I'm fairly confident that auto-decrypting and rendering HTML is far 
more prevalent than running the MUA as root.

It's trivial for an end user to get an MUA to do that without requiring 
administrative privileges at all.  Some MUAs, like the iPhone, do this 
automatically and end users have to go way out of their way to get root 
level access.

IMHO Efail is completely an unprivileged user level target.

-- 
Grant. . . .
unix || die

---

From: Vladimir Dubrovin <[email-masked]>
Date: Fri, 18 May 2018 17:09:45 +0300

EFAIL exploitation requires MitM conditions. Neither DKIM nor DMARC
protect against attacker able to perform MitM.

-- 
Vladimir Dubrovin
@Mail.Ru

---

From: Steve Atkins <[email-masked]>
Date: Fri, 18 May 2018 07:16:38 -0700

> On May 18, 2018, at 7:09 AM, Vladimir Dubrovin <[email-masked]> wrote:
> 
> 
> EFAIL exploitation requires MitM conditions. Neither DKIM nor DMARC protect against attacker able to perform MitM.
> 

It just requires the attacker to have a copy of the encrypted mail. Passive mitm is one approach to that, but only one of many.

Cheers,
  Steve

---

From: Vladimir Dubrovin <[email-masked]>
Date: Fri, 18 May 2018 17:54:20 +0300

Another case is you e-mail account is compromised, and DKIM/DMARC are
helpless again.

Actually, you probably do not need to spoof the e-mail address and can
attack with random From:, because message is decoded regardless of
address in the From: and this attack does not require sender's signature
to be checked. I haven't checked though.

P.S.
In addition, in most MUAs vulnerable, you can bypass DKIM/DMARC (and
actually any headers check on MTA side) with message/partial. This kind
of bypass is explained here
http://securityvulns.comLdocument310.html
but it's another story.

-- 
Vladimir Dubrovin
@Mail.Ru