Re: More mail madness?

[Russ Housley <housley@xxxxxxxxxxxx>]

We are working on text for S/MIME that says that each portion of a MIME multi-part needs to be handled in its own sandbox.  The direct exfiltration that is described happens because the mail user agent glues the various portions together for display to the user, which in the example on the web page causes an image to be fetched from the attacker's website with the message plaintext as part of the URL.

Russ

On May 14, 2018, at 11:52 AM, Phillip Hallam-Baker <phill@xxxxxxxxxxxxxxx> wrote:

This is a security issue certainly, but it is a particular type of issue that arises from attempting to analyze the security of a large and complex system built from parts whose interactions as so complicated that they are never likely to be sufficiently understood.

https://efail.de/

Basically the attack is to create a new multipart MIME message and sandwich the ciphertexts we wish to break between chunks of HTML with a URL reference to a web server we control.

This sort of attack could be devastating in certain situations.

The other attack they describe, the CBC gadget attack is one that I have already been using a control against. I use a key derivation function to calculate IVs rather than passing them in-band. I started doing this because it cleans up the message flows a lot but it also turns out to have security advantages.