Re: What’s up Johnny? - DEF CON CON 27/DEF CON 27... · S/MIME PGP S/MIME PGP Windows Thunderbird Outlook Win. 10 Mail Win Live Mail The Bat! Postbox eM Client Linux KMail Evolution

Re: What’s up Johnny?Covert Content Attacks on Email End -To-End Encryption

Jens Müller, Marcus Brinkmann, Damian Poddebniak,Sebastian Schinzel, Jörg Schwenk

Remember EFAIL?

2

• Last year: EFAIL

Remember EFAIL?

2

• Last year: EFAIL– Major attack with a logo

Remember EFAIL?

2


– Novel attack techniques

targeting S/MIME + PGP

Remember EFAIL?

2




• Today: non-crypto attacks

Remember EFAIL?

2




• Today: non-crypto attacks– Targeting encryption and digital signatures

Remember EFAIL?

2

1. Introduction2. Attacks on Encryption3. Attacks on Signatures4. Evaluation5. Mitigation

Overview

3


Overview

3

Technology's promise

4

I. “Strong crypto is virtually unbreakable.”


4

I. “Strong crypto is virtually unbreakable.”II. “Digital signature will prevail. Math wins.”


4

I. “Strong crypto is virtually unbreakable.”II. “Digital signature will prevail. Math wins.”


…claims I. and II. could be bypassed witha single reply to a benign looking email?

What if…

4

From: [email protected]: [email protected]: Important news

Some ASCII text message…

Traditional RFC822 email

5




5




5


-----BEGIN PGP MESSAGE-----…-----END PGP MESSAGE-----

Traditional PGP/Inline

6




6




6

Multipart MIME email

7

Content-type: text/plain



This is the 2nd part

From: [email protected]: [email protected]: multipart/mixed; boundary="XXX"

--XXX

--XXX

--XXX--


7






--XXX

--XXX

--XXX--


7






--XXX

--XXX

--XXX--


7






--XXX

--XXX

--XXX--


7






--XXX

--XXX

--XXX--


multipart/mixed

7






--XXX

--XXX

--XXX--


multipart/mixed

texttext

7


--XXX

--XXX

--XXX--

Content-type: text/html

<b>HTML</b> message…

Content-type: application/pdf

%PDF-1.4 […]


multipart/mixed

pdfhtml

7

From: [email protected]: [email protected]: Important newsContent-Type: application/pkcs7-mime

MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…

S/MIME

8



S/MIME

8



S/MIME

8

OpenPGP (RFC 4880)• Favored by privacy advocates• Web-of-trust (no authorities)

S/MIME (RFC 5751)• Favored by organizations• Multi-root trust-hierarchies

Two competing standards

9

OpenPGP (RFC 4880)• Favored by privacy advocates• Web-of-trust (no authorities)

S/MIME (RFC 5751)• Favored by organizations• Multi-root trust-hierarchies

Two competing standards

9


Overview

10


Overview

10

Attacker model

11

• Eve has captured ciphertext

Attacker model

11

• Eve has captured ciphertext• Can modify email structure

Attacker model

11

• Eve has captured ciphertext• Can modify email structure • Can re-send it to the victim

Attacker model

11


– Either to recipient or sender

Attacker model

11


– Either to recipient or sender– Both can decrypt the email

Attacker model

11

Covert content attack: Decryption oracle

12


12


12


12

To: [email protected]

Decryption oracle

From: [email protected]

Content-Type: application/pkcs7-mime


13


Decryption oracle




13


Decryption oracle




13


Decryption oracle




13


Decryption oracle




13

Content-type: multipart/mixed; boundary="XXX"

--XXX

--XXX

--XXX--


Decryption oracle




13


--XXX

--XXX

--XXX--


Decryption oracle





What's up Johnny?

13


--XXX

--XXX

--XXX--


Decryption oracle





What's up Johnny?

multipart/mixed

???text

13


--XXX

--XXX

--XXX--


Secret message, for Johnny's eyes only…


Decryption oracle



What's up Johnny?

multipart/mixed

text secret

13


--XXX

--XXX

--XXX--




Decryption oracle



What's up Johnny?

13


--XXX

--XXX

--XXX--




Decryption oracle



What's up Johnny?

13


--XXX

--XXX

--XXX--




Decryption oracle



What's up Johnny?\n\n\n\n\n\n…

13


--XXX

--XXX

--XXX--




Decryption oracle



What's up Johnny?\n\n\n\n\n\n…

13


--XXX

--XXX

--XXX--




Decryption oracle



What's up Johnny? <!--

13


--XXX

--XXX

--XXX--




Decryption oracle



What's up Johnny? <!--

13


--XXX

--XXX

--XXX--

Content-ID: <part2>



Decryption oracle



What's up Johnny? <img src="cid:part2">

13


--XXX

--XXX

--XXX--

Content-Disposition: attachment



Decryption oracle



What's up Johnny?

13


Overview

14


Overview

14

Covert content attack: Signing oracle

15


15


15


15


15

From: [email protected]: [email protected]: text/html

What's up Johnny?I hereby declare war.

Signature oracle

16

Signature oracle


What's up Johnny?<div class="covert"> I hereby declare war. </div>

16

Signature oracle


<style>IF condition:Hide * but show .covert

</style>What's up Johnny?<div class="covert">I hereby declare war.</div>

16

Signature oracle


<style>@media (max-device-width: 834px) {.covert {visibility: hidden;}}


hide covertcontent on mobile devices

16

Signature oracle


<style>@media (max-device-width: 834px) {.covert {visibility: hidden;}}

@media (min-device-width: 835px) {* {visibility: hidden;}.covert {visibility: visible}}


but show on desktop devices

16

I'm fine, thanks.

On 01/05/19 09:53, Eve wrote:> What's up Johnny?

Re: What's up Johnny?

17

I'm fine, thanks.



Reply email sent from Johnny’s mobile phone

17

I'm fine, thanks.




17

I'm fine, thanks.



I hereby declare war.

Signed email received on a desktop device


17

Conditional rules

18

• Targeting device type (@media)

Conditional rules

18

• Targeting device type (@media)• Targeting email client (@supports)

Conditional rules

18

• Targeting device type (@media)• Targeting email client (@supports)• Targeting user account (@document)

Conditional rules

18

• Targeting device type (@media)• Targeting email client (@supports)• Targeting user account (@document)

Conditional rules

18


Overview

19


Overview

19

OS ClientDecryption Signatures

S/MIME PGP S/MIME PGP

Windows

ThunderbirdOutlookWin. 10 MailWin Live MailThe Bat!PostboxeM Client

Linux

KMailEvolutionTrojitáClawsMutt

macOSApple MailMailMateAirmail

iOS Mail App

Android

K-9 MailR2Mail2MailDroidNine

Web

Exchange/OWARoundcubeHorde/IMPMailpile

● Plaintext can be completely hidden

◐ Plaintext merged with attacker-text

○ No vulnerabilities found

– Cryptosystem not available

Decryption oracles

● Covert rules kept in reply message

◐ Covert rules only for received mail

Signature oracles

20



Windows

Thunderbird ●Outlook ○Win. 10 Mail ○Win Live Mail ○The Bat! ○Postbox ●eM Client ○

Linux

KMail ◐Evolution ◐Trojitá ◐Claws ◐Mutt ◐

macOSApple Mail ●MailMate ●Airmail ●

iOS Mail App ●

Android

K-9 Mail –R2Mail2 ○MailDroid ○Nine ○

Web

Exchange/OWA ○Roundcube –Horde/IMP ○Mailpile –





Decryption oracles



Signature oracles

20



Windows

Thunderbird ● ●Outlook ○ ○Win. 10 Mail ○ –Win Live Mail ○ –The Bat! ○ ○Postbox ● ●eM Client ○ ○

Linux

KMail ◐ ◐Evolution ◐ ◐Trojitá ◐ ◐Claws ◐ ◐Mutt ◐ ◐

macOSApple Mail ● ●MailMate ● ●Airmail ● ●

iOS Mail App ● –

Android

K-9 Mail – ○R2Mail2 ○ ●MailDroid ○ ○Nine ○ –

Web

Exchange/OWA ○ –Roundcube – ◐Horde/IMP ○ ○Mailpile – ○





Decryption oracles



Signature oracles

20



Windows

Thunderbird ● ● ●Outlook ○ ○ ◐Win. 10 Mail ○ – ◐Win Live Mail ○ – ●The Bat! ○ ○ ○Postbox ● ● ●eM Client ○ ○ ◐

Linux

KMail ◐ ◐ ○Evolution ◐ ◐ ◐Trojitá ◐ ◐ ◐Claws ◐ ◐ ○Mutt ◐ ◐ ○

macOSApple Mail ● ● ◐MailMate ● ● ●Airmail ● ● ●

iOS Mail App ● – ●

Android

K-9 Mail – ○ –R2Mail2 ○ ● ◐MailDroid ○ ○ ●Nine ○ – ●

Web

Exchange/OWA ○ – ●Roundcube – ◐ ◐Horde/IMP ○ ○ ◐Mailpile – ○ –





Decryption oracles



Signature oracles

20



Windows

Thunderbird ● ● ● ●Outlook ○ ○ ◐ ◐Win. 10 Mail ○ – ◐ –Win Live Mail ○ – ● –The Bat! ○ ○ ○ ○Postbox ● ● ● ●eM Client ○ ○ ◐ ◐

Linux

KMail ◐ ◐ ○ ○Evolution ◐ ◐ ◐ ◐Trojitá ◐ ◐ ◐ ◐Claws ◐ ◐ ○ ○Mutt ◐ ◐ ○ ○

macOSApple Mail ● ● ◐ ◐MailMate ● ● ● ●Airmail ● ● ● ●

iOS Mail App ● – ● –

Android

K-9 Mail – ○ – ●R2Mail2 ○ ● ◐ ◐MailDroid ○ ○ ● ●Nine ○ – ● –

Web

Exchange/OWA ○ – ● –Roundcube – ◐ ◐ ◐Horde/IMP ○ ○ ◐ ◐Mailpile – ○ – ○





Decryption oracles



Signature oracles

20



Windows

Thunderbird ● ● ● ●Outlook ○ ○ ◐ ◐Win. 10 Mail ○ – ◐ –Win Live Mail ○ – ● –The Bat! ○ ○ ○ ○Postbox ● ● ● ●eM Client ○ ○ ◐ ◐

Linux

KMail ◐ ◐ ○ ○Evolution ◐ ◐ ◐ ◐Trojitá ◐ ◐ ◐ ◐Claws ◐ ◐ ○ ○Mutt ◐ ◐ ○ ○

macOSApple Mail ● ● ◐ ◐MailMate ● ● ● ●Airmail ● ● ● ●

iOS Mail App ● – ● –

Android

K-9 Mail – ○ – ●R2Mail2 ○ ● ◐ ◐MailDroid ○ ○ ● ●Nine ○ – ● –

Web

Exchange/OWA ○ – ● –Roundcube – ◐ ◐ ◐Horde/IMP ○ ○ ◐ ◐Mailpile – ○ – ○





Decryption oracles



Signature oracles

20


Overview

21


Overview

21

Decryption oracles

22

• Accepting ASCII text only

Decryption oracles

22

• Accepting ASCII text only

Decryption oracles

22

• Accepting ASCII text only• Enforcing digital signatures

Decryption oracles

22

• Accepting ASCII text only• Enforcing digital signatures

Decryption oracles

22

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption

Decryption oracles

22

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption

Decryption oracles

22

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption• All-or-Nothing Encryption

Decryption oracles

22

• Accepting ASCII text only• Enforcing digital signatures• Warn on partial encryption• All-or-Nothing Encryption

Decryption oracles

Root causes: long-term keys +ciphertext usage out-of-context

22

Signing oracles

23

• Dropping CSS Support

Signing oracles

23

• Dropping CSS Support

Signing oracles

23

• Dropping CSS Support• Only ASCII Text in replies

Signing oracles

23

• Dropping CSS Support• Only ASCII Text in replies• Remove styles from replies

Signing oracles

23

Conclusion

24

• Crypto is not enough, bypasses exist

Conclusion

24

• Crypto is not enough, bypasses exist• 22 of 24 tested clients are vulnerable

Conclusion

24

• Crypto is not enough, bypasses exist• 22 of 24 tested clients are vulnerable• Building security on top of email is hard

Conclusion

24

• Crypto is not enough, bypasses exist• 22 of 24 tested clients are vulnerable• Building security on top of email is hard

Conclusion

Thank you! Questions?Exploits: github.com/RUB-NDS/Covert-Content-Attacks

24

https://github.com/RUB-NDS/Covert-Content-Attacks

HTML and CSS support in various email clients

Proprietary conditional features

Blinding options

Documents

Re: What’s up Johnny? - DEF CON CON 27/DEF CON 27... · S/MIME PGP S/MIME PGP Windows Thunderbird Outlook Win. 10 Mail Win Live Mail The Bat! Postbox eM Client Linux KMail Evolution