Researchers claim to have discovered a set of vulnerabilities

Security researchers claim to have discovered a set of vulnerabilities (collectively called Efail) that affect users of certain email clients that utilise PGP (Pretty Good Privacy) and S/MIME (Secure/ Multipurpose Internet Mail Extensions) - two widely used methods for encrypting emails. The security loopholes are claimed to expose the plaintext of encrypted emails to attackers and put even those emails at risk that were sent in the past. Users are advised to stop using tools that decrypt PGP or S/MIME encrypted emails. Researchers say that for now, no reliable fixes are available for the vulnerability.

Sebastian Schinzel, a professor of computer security at Münster University of Applied Sciences, claimed that the latest issues affecting tools that use PGP and S/MIME impact not just new emails but also exposes the encrypted emails sent in the past. "There are currently no reliable fixes for the vulnerability. If you use PGP/GPG or S/MIME for very sensitive communication, you should disable it in your email client for now," Schinzel wrote in a tweet.

Schinzel, alongside his fellow security experts at Münster University of Applied Sciences as well as the researchers at Ruhr University Bochum and KKU Leuven, jointly published their research detailing the flaws. "We use CBC/CFB gadgets to inject malicious plaintext snippets into encrypted emails that abuse existing and standard-conforming backchannels, for example, in HTML, CSS, or x509 functionality, to exfiltrate the full plaintext after decryption. The attack works for emails even if they were collected long ago, and is triggered as soon as the recipient decrypts a single maliciously crafted email from the attacker. The attack has a large surface, since for each encrypted email sent to n recipients, there are n + 1 mail clients that are susceptible to our attack," the abstract of the research paper reads.

Electronic Frontier Foundation (EFF) in a separate blog post recommended users to immediately disable email tools that automatically decrypt PGP-encrypted email. "Our advice, which mirrors that of the researchers, is to immediately disable and/ or uninstall tools that automatically decrypt PGP-encrypted email," the EFF team said, adding, users should use alternative end-to-end secure channels, such as Signal, and temporarily stop sending and "especially reading" PGP-encrypted email. Furthermore, separate guides have been provided to disable PGP plugins in Thunderbird, Apple Mail, and Outlook.

Germany's Federal Office for Information Security (BSI) put out a statement saying there were risks that attackers could secure access to emails in plaintext once the recipient had decrypted them.

It added, however, that it considered the encryption standards themselves to be safe if correctly implemented and configured. Werner Koch of GnuPG, a popular provider of GPG encryption, said the vulnerability was not in the encryption protocols, but rather, in the email clients used to decrypt them. Specifically, if they handle MDC (modification detection code) errors correctly, Koch's colleague Robert J. Hansen said, and the above-named clients appear to be some of those that are vulnerable.

The use of PGP for secure communications has been advocated, among others, by Edward Snowden, who blew the whistle on pervasive electronic surveillance at the US National Security Agency before fleeing to Russia.

PGP, for example, works using an algorithm to generate a 'hash', or mathematical summary, of a user's name and other information. This is then encrypted with the sender's private 'key' and decrypted by the receiver using a separate public key.

To exploit the weakness, a hacker would need to have access to an email server or the mailbox of a recipient. In addition the mails would need to be in HTML format and have active links to external content to be vulnerable, the BSI said.

It advised users to disable the use of active content, such as HTML code and the loading of external content, and to secure their email servers against external access.

Researchers have discovered a malware called Vega Stealer

Researchers have discovered a malware called Vega Stealer that is said to have been designed to harvest financial data from the saved credentials of Google Chrome and Mozilla Firefox browsers. The malware is another variant of August Stealer crypto-malware that steals credentials, sensitive documents, cryptocurrency wallets, and other details stored in the two browsers. As of now, the Vega Stealer is only being used in small phishing campaigns, but researchers believe that the malware can potentially result in major organisational level attacks.

According to researchers from Proofpoint, a campaign was found to be targeting Marketing/ Advertising/ Public Relations, and Retail/ Manufacturing industries with a new malware. On May 8 this year, the researchers observed and blocked a low-volume email campaign with subjects such as 'Online store developer required'. The email contains an attachment called 'brief.doc', which contains malicious macros that download the Vega Stealer payload. They said that while some emails were sent to individuals, others were sent to distribution lists including 'info@', 'clientservice@', and 'publicaffairs@' at the targeted domains. It is an approach that has the effect of amplifying the number of potential victims.

The Vega Stealer ransomware allegedly takes special aim at those in the marketing, advertising, public relations, and retail/ manufacturing industries. Once the document is downloaded and opened, a two-step download process is initiated. "The first request executed by the document retrieves an obfuscated JScript/PowerShell script. The execution of the resulting PowerShell script creates the second request, which in turn downloads the executable payload of Vega Stealer," the report said. It added, "The payload is saved to the victim machine in the user's "Music" directory with a filename of 'ljoyoxu.pkzip'. Once this file is downloaded and saved, it is executed automatically via the command line."

Vega Stealer is written in .NET and aims to steal saved credentials such as passwords, saved credit cards, profiles, and cookies, and payment information in Google Chrome. And, in the Firefox browser, the malware harvests specific files - 'key3.db,' 'key4.db,' 'logins.json,' and 'cookies.sqlite' - which store different passwords and keys.

Vega Stealer keeps on working, and takes a screenshot of the infected PC and scans for any files on the system ending in .doc, .docx, .txt, .rtf, .xls, .xlsx, or .pdf for exfiltration.

The researchers claim that the document macro and URLs involved in the campaign suggest that the same threat actor responsible for campaigns spreading financial malware. They could not attribute Vega Stealer to any specific group, it was able to associate this malware with other types now being used. They said that the malicious macro is available for sale and threat actors are using it by pushing the Emotet banking trojan. Meanwhile, the URL patterns from which the macro retrieves the payload are the same as those used by an actor who distributes the Ursnif banking trojan, which often downloads secondary payloads such as Nymaim, Gootkit, or IcedID, the researchers said.

While Vega Stealer is not the most complex malware in circulation today, it does demonstrate the flexibility of malware, authors, and actors to achieve criminal objectives.

In order to be safe, Ankush Johar, Director at Infosec Ventures, said in a press statement, "Organisations should take cyber awareness seriously and make sure that they train their consumers and employees with what malicious hackers can do and how to stay safe from these attacks. One compromised system is sufficient to jeopardize the security of the entire network connected with that system."