EFAIL Vulnerability

Following the news that a serious flaw was found in secure email tech, PGP,  IT security experts commented below.

Laurie Mercer, Solutions Engineer at HackerOne: 

“This vulnerability affects email clients that use the OpenPGP and S/MIME standards, including Apple Mail, iOS Mail and Thunderbird. Direct exfiltration is one of the most severe content injection vulnerabilities. The ability to decrypt old emails will especially appeal to attackers who have access to encrypted emails but are unable to decrypt them. A temporary recommendation is to disable HTML rendering of emails. This workaround is complicated by the fact that all recipients of an email can decrypt, so all recipients need to follow the same advice.

CVE-2017-17688 and CVE-2017-17689 were reserved on December 15th 2017. Nearly 5 months have passed since this date, yet many email clients have no patch. Patch management cannot protect organisations if no patch exists. This raises questions about how software vendors, standards organisations and open source projects can best coordinate with security researchers to ensure that vulnerabilities are reported to the right people and remediated before being disclosed publicly.”

Dr Guy Bunker, SVP of Products at Clearswift:

“The recent incident regarding the PGP flaw highlights that there is a 3^rd party Open Source software out there – which people rely upon heavily to encrypt their sensitive data – which has vulnerabilities that no one knows about until it is too late. This is not the first time that this has happened, however. In fact, we get 2-3 of these every year, the most high profile case of this happening recently was the Intel (Spectre/Meltdown) flaw.

“Some vulnerabilities impact millions of users, some, like that found in Drupal has an impact on 100,000’s. In most cases, the challenge the organisation has is to stay up-to-date with the list of flaws which are being released – and there are a number of sites which break the news. This should then be followed by ensuring that any patches which have been released by the vendors are applied in a timely manner, before the vulnerability is exploited.

“While it is relatively simple to apply patches to a laptop or a desktop, applying to servers or to systems in the cloud (where the organisation might not have any control over timing) is more challenging. For many organisations, patches have to be tested before they can be applied to production systems, and this can take weeks or months – not just hours or even days. For a large database application server there could be patches for the OS, database, application, middleware and even the web server, so a system might be in a permanent state of being patched against critical vulnerabilities. Lack of patching opens the organisation up to an attack and, for systems which face the Internet, finding out this information is all too easy.

“Organisations rely on Open Source software, even if they don’t always realise it. It does come with risks but understanding the risks mean they can be ameliorated. Closing your eyes and ignoring them could be devastating to any organisation.”

Steven Malone, Director Of Security Product management at Mimecast:

“EFAIL attacks highlight the on-going security weaknesses inherent within email and the need for robust layers of additional defence. S/MIME is legacy technology that is often hard to setup and maintain. It’s vital that organisations review their exposure to any use of these encryption standards and affected clients.

“Privacy and security often have competing demands that need to be carefully balanced for any organisation”