5 ms·

> (in fact I am not aware of any client that is vulnerable to this) > First, the direct exfiltration attack abuses vulnerabilities in Apple Mail, iOS Mail and

• dijit 8y ago
  I can see how it would work against Apple Mail/iOS Mail since they load HTML and external elements by default. I would be interested to see the attack working on a Thunderbird client with Enigmail installed and no other settings changes (like; loading external resources).
  • baby 8y ago
    According to this table Thunderbird is vulnerable: https://twitter.com/matthew_d_green/status/995998626785714177 https://twitter.com/matthew_d_green/status/99599862678571417...
    • jcranmer 8y ago
      Thunderbird disables remote loading by default. It's vulnerable only if you take measures to override this, which is to say, you either: 1. Use movemail to receive email instead of IMAP or POP (there's an interesting vector to get your remote resources loaded by using movemail. If you read the code, you can probably guess it). 2. Enable remote loading for all senders by default. 3. Try to send an email with a sender you think will be whitelisted. 4. Convince the user to click on a link.
      • jakobegger 8y ago
        Since the exploit depends on sending manipulated emails, I think that 3. and 4. are pretty easy, since it'll look like the email is from a trusted sender (and encrypted)
        • flatline 8y ago
          The encrypted messages will not be signed, unless the trusted sender is also the attacker or their key is compromised.
          • jakobegger 8y ago
            Does Thunderbird verify that the message is signed before displaying images from a whitelisted sender?
      • tom_mellior 8y ago
        > Thunderbird disables remote loading by default. From the paper: "For example, in Thunderbird and Postbox we can completely redress the UI with CSS and trick the user into submitting the plaintext with an HTML form if he clicks somewhere into the message." This is bad news. Also, they claim/suggest that the following: <link href="http://efail.de" rel="preconnect"> is a "bypass for remote content blocking" in Thunderbird, whatever that may mean exactly. EDIT: Mozilla's docs at https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types say about preconnect: "Provides a hint to the browser suggesting that it open a connection to the linked web site in advance, without disclosing any private information or downloading any content, so that when the link is followed the linked content can be fetched more quickly." (emphasis mine). If that is really the spec and I understand it correctly and Thunderbird behaves differently, then that seems like a bug in Thunderbird.
        • bscphil 8y ago
          Allowing preconnects when remote resource loading is disabled would be a serious security fail, so I hope that's not what Thunderbird is doing. Suppose I initiated a connection to long-unique-identifier.mysite.com? At minimum this could be used for tracking beacons, possibly even to exfiltrate data.
    • xorcist 8y ago
      This is the weird part. Sure, Outlook 2007 and Apple Mail are vulnerable, but if you are really parsing untrusted HTML with these clients you probably have more pressing problems (running arbitrary code, perhaps). From a quick test it seems like a completely standard Thunderbird/Enigmail not only checks the error code from gpg, but also doesn't render HTML by default. There must be something more to this, unless something was fixed quite recently, in which case that would seem very relevant to the announcement.
• AnaniasAnanas 8y ago
  Not with Engimail 2+. (I was also not aware of Apple mail's and iOS Mail's existence so technically my statement was true)