1412632 - TBE-01-005 Enigmail: Replay of encrypted Contents leads to Plaintext Leak

Status: RESOLVED FIXED

(Thunderbird :: General, defect)

Description

[Patrick Brunschwig]

This bug concerns Enigmail. I reported it in Bugzilla such that all issued of the cure53 security audit of Enigmail (+ Thunderbird) are filed together.

An attacker can retrieve plaintext of encrypted mails, provided that they were previously sent to the victim. This can be achieved by including the encrypted data block into the email’s body. If the victim responds to the email in question without discarding the original message, the decrypted content is leaked to the attacker. Enigmail supports partially encrypted emails wherein only a selection of the message’s body is encrypted. This is what makes the attack realistic, since encrypted message blocks can be hidden in longer conversations.

Steps to reproduce:
* Mallory intercepts an encrypted message sent from Alice to Bob.
* Mallory starts a conversation with Bob. In order to make this attack work, Bob must not discard the original message when replying to an email.
* At some point when the conversation is long enough, Mallory slips the intercepted PGP block into the conversation and leaves the rest of the email unencrypted.
* When Bob receives the message, the PGP block will be decrypted automatically.
* As Bob will likely not read the earlier conversation again, he will have no way of
noticing the additional text. However, if he expectedly responds to the message, the decrypted content will be leaked to Mallory.

An alternative way to exploit this issue requires social engineering and makes use of Thunderbird’s forwarding feature. Actions that need to be completed for this alternative route are enumerated next.
Steps to reproduce:
1. Mallory intercepts an encrypted message which is sent from Alice to Bob.
2. Mallory sends Bob a very long text message which includes the encrypted PGP block and a short text which convinces Bob to forward this email to Trudy without
reading the actual message.
3. If Bob follows Mallory’s instructions and forwards the email, Enigmail will
automatically decrypt the included PGP block and the plaintext is leaked to Trudy.

It should be noted that this issue is rather a design flaw. Specifically, it predominantly relies on the unawareness or lazy behavior of users.

Enigmail already displays an info box when an email contains partly encrypted data. However, this message can be easily overseen or ignored. It is recommended to leave messages about partial encryption when they are being forwarded or responded to. It is alternatively recommended to display a clear warning when a response to a partly encrypted message is composed or when such a message is forwarded.


For full details, see the original report as PDF in bug 1411701.

Comment 1

[Patrick Brunschwig]

The solution for inline-PGP not difficult to implement, as the decryption happens in the composer window. All that's needed is to check if there is text before or after the encrypted part and if yes, display a warning.


For PGP/MIME this is more difficult, as you need to know the structure of the original message that are replying or forwarding. If the original message structure is e.g. as follows, then a warning should be displayed:

multipart/mixed
  |-- text/plain
  |-- multipart/encrypted (PGP/MIME)
      |-- text/plain
 
I assume that this also affects S/MIME.

Comment 2

[Patrick Brunschwig]

The case of the multipart/mixed message containing an embedded multipart/encrypted part is less complex than I thought. No email client can produce such a message structure. That is, if we detect such a message structure, it's pretty safe to just display a warning to the user, independently of what the content of the multipart/encrypted part is.

Comment 3

[Patrick Brunschwig]

Implemented warning message for inline-PGP:
https://sourceforge.net/p/enigmail/source/ci/945a5f36c0817cad8bdf1c70112205a22502ee32

Comment 4

[Patrick Brunschwig]

Implemented warning message for PGP/MIME messages:
https://sourceforge.net/p/enigmail/source/ci/8d3afec4f1c3c8faf4a6a93bf38cb508d17e6b7a

The warning is displayed whenever a multipart/encrypted part is found inside some other MIME part, unless the "other" MIME part is a message/rfc822 part (which would be a non-decrypted attachment).