Thanks to OpenPGP, attackers cannot read emails even if they have access to the email account. "It is precisely this encryption technology that we can now break," says Prof. Dr. Sebastian Schinzel from the Department of Electrical Engineering and Computer Science at Münster University of Applied Sciences.

Together with his team and scientists from the Ruhr University Bochum (RUB) and the Katholieke Universiteit Leuven, he has uncovered this security gap. The same applies to the equally common encryption technology S/MIME. This makes it possible for attackers to read even additionally encrypted e-mails on the Internet.

Outdated standard

The researchers call their attack "Efail", and it was successful in 25 out of 35 email programs tested for S/MIME and in 10 out of 28 for OpenPGP. In other Internet standards such as TLS, short for Transport Layer Security, a protocol for encrypting data transmissions on the Internet, this type of cryptography has already been broken several times. "However, this is the first time we have proven its vulnerability in email encryption," explains Prof. Dr. Jörg Schwenk from the RUB Chair of Network and Data Security.

The problem is that the flaw lies in the standard: OpenPGP and S/MIME have been in use since the 1990s without any major updates. They are the mathematical envelope for e-mails that are otherwise sent through the Internet like postcards.

Attack through the back door

"In our attack, we modified the encrypted emails so that external images are loaded," explains Schinzel. This happens via HTTP links and parts of the plain text, the content of the message, are then embedded in the path of these links. By the time the modified email is displayed to the recipient, it is already too late - the plain text has already been sent to the attacker.

Many companies encrypt their email traffic with S/MIME, while OpenPGP is more commonly used by individuals. Both encryption methods are currently unsuitable for secure communication. The research team is now calling for a new standard from the Internet Engineering Task Force.