A team of security researchers have uncovered a serious flaw in several major email clients you need to be aware of.
The flaw allows hackers to fake verified signatures, which gives their phishing and other email-based attacks the appearance of legitimacy.
According to research conducted by the team, the following email clients are vulnerable to this exploit:
- Thunderbird
- Apple Mail with GPGTools
- iOS Mail
- Microsoft Outlook
- Mailpile
- Roundcube
- K-9 Mail
- Airmail
- MailMate
- Evolution
- KMail
- GpgOL
What The Risks Are
Ostensibly, an email signature is supposed to provide end-to-end authenticity, legitimacy, and integrity. When you receive an email containing a verified signature, it's a sign that it's from a safe, trusted source. Unfortunately, now that several of the largest and most widely used email clients have been found to be vulnerable to signature spoofing attacks, that's out the window. If you've been in the habit of scanning for a verified signature and then, upon finding one, assuming the email is safe, it's simply no longer safe to do that.
The research team described their research in part, by saying the following:
"In our scenario, we assume two trustworthy communication partners, Alice and Bob, who have securely exchanged their public PGP keys or S/MIME certificates. The goal of our attacker Eve is to create and send an email with arbitrary content to Bob, whose email client falsely indicates that the email has been digitally signed by Alice.
Our attack model does not include any form of social engineering. The user opens and reads received emails as always, so awareness training does not help to mitigate the attacks."
That's dark news indeed, and even worse, a raft of CVE's have been opened to account for and fix the vulnerabilities that make this type of signature spoofing possible. However, there are no easy fixes here, and there's no timetable at this point from any of these email providers on when or if the issues will be resolved.
