As reported by the researcher, the attack is similar to ‘phreaking’ phone lines – a method used in 1970’s for manipulating telephone call routing. Brinkmann termed this vulnerability, identified as CVE-2018-12020, as ‘SigSpoof’. As stated in his blog,
“The signature verification routine in Enigmail 2.0.6.1, GPGTools 2018.2, and python-GnuPG 0.4.2 parse the output of GnuPG 2.2.6 with a “--status-fd 2” option, which allows remote attackers to spoof arbitrary signatures via the embedded “filename” parameter in OpenPGP literal data packets, if the user has the verbose option set in their gpg.conf file.”
Yet, he expressed his concern about how this vulnerability posed a risk of hacking to the critical infrastructure for several decades.
“The vulnerability in GnuPG goes deep and has the potential to affect a large part of our core infrastructure. GnuPG is not only used for email security, but also to secure backups, software updates in distributions, and source code in version control systems like Git.”Email encryption vulnerabilities always arise as a serious threat to cybersecurity. A few weeks earlier, EFAIL bug in PGP and S/MIME encryption tools was discovered that exposed encrypted emails in plain text. Now that another bug has been discovered to allow for digital signatures to be spoofed, certainly there seems to be demand for more attention for improvement in email encryption.
Let us know your thoughts in the comments section below.
