The underpinnings of the research stem from how email clients abuse active content, like externally loaded images or styles, in HTML emails. #efail 1/4- Sebastian Schinzel May 14, 2018ĭue to our embargo being broken, here are the full details of the #efail attacks. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past. We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 07:00 UTC. This prompted researchers to publish the full details of their paper, “Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels,' (.PDF) Monday morning.

The research, which is being referred to as “ EFAIL,” was slated for publication on Tuesday but similar to January's Meltdown and Spectre vulnerabilities, the hype around the embargo was too much to sustain. There are no patches or even reliable fixes for the vulnerabilities in lieu of a fix the researchers are encouraging users to disable the standards if they're using them for encrypted email. A set of vulnerabilities dubbed 'EFAIL' affect encryption standards like PGP and S/MIME and could reveal the plaintext of encrypted emails sent in the past.Ī group of European researchers and professors on Sunday disclosed a series of vulnerabilities in PGP and S/MIME, internet standards used for delivering end-to-end encrypted emails, that theoretically could be exploited to decrypt the plaintext contents of emails sent in the past.

Gpg mail client