Weak cryptography keys allow others to add valid DKIM signatures to fake emails

Posted by   Virus Bulletin on   Oct 25, 2012

512-bit key cracked within 72 hours.

A Florida-based mathematician has caused a stir in the email community by adding a valid DKIM signature for google.com to an email after cracking the company's private signing-key.

When the first SMTP standard was published just over three decades ago, email spam barely existed. The email landscape has changed beyond recognition since 1982, and various enhancements have been introduced to help tackle the problem of correctly filtering thousands or even millions of emails per day. DKIM (DomainKeys Identified Mail), which has gained momentum in recent years, is one such feature.

DKIM - which is easily and commonly misunderstood - adds a domain-based digital signature to an email. A valid DKIM signature does not mean the message is not spam, nor does it make any claims about the verity of the content or headers of the email. A valid DKIM signature merely says that the message passed through the mail servers of the signing domain.

Yet in this apparent weakness also lies DKIM's strength: unlike any other part of the email (bar the sending IP address), you can be certain that this domain is not forged. Hence you can use this fact to increase the spam-probability for one domain that is known to send a lot of spam, decrease it for another that you trust to filter outbound email, and make sure you never mark emails from a third, highly trusted, domain as spam.

If, for instance, you believe that Google doesn't mess things up internally, you can be sure that an email claiming to come from larry@google.com with a valid DKIM signature for google.com was indeed sent by Google co-founder Larry Page.

But, like so many applications of cryptography, the sound mathematics behind DKIM has little value when the implementation is poor.

Zachary Harris, a Florida-based mathematician, recently discovered that Google was using a 512-bit DKIM key. Without having prior knowledge of DKIM, it took him 72 hours to crack the key and thus he was able to sign a faked message from Larry Page to his fellow co-founder Sergey Brin. Harris did not receive any response to this email, but Google did replace its key with a 2048-bit one.

Google isn't the only high-profile organization to have used a weak key: eBay, Yahoo, Twitter and Amazon all used 512-bit keys, while PayPal, LinkedIn, US Bank and HSBC used keys that were 768 bits long - still too weak for companies that are heavily phished.

After having been contacted by Harris, most companies fixed their keys - though after a few failed to do so, he decided to contact US-CERT and go public with his discovery. A US-CERT announcement can be found here.

DKIM will not solve the spam problem (nor does it claim to do so), but it does add an extra layer of trust to email. With the increase in targeted attacks we have seen recently - the people behind which would generally think nothing of spending 72 hours and an apparent US$75 to crack a key - its importance is likely to increase and thus it is a good thing that DKIM is applied by most major email senders these days. But if they sign their emails with weak keys, they would perhaps do better not to sign them at all.

More at Wired here.

Posted on 25 October 2012 by Martijn Grooten



Latest posts:

VB2017 paper: Walking in your enemy's shadow: when fourth-party collection becomes attribution hell

We publish the VB2017 paper and video by Kaspersky Lab researchers Juan Andres Guerrero-Saade and Costin Raiu, in which they look at fourth-party collection (spies spying on other spies' campaigns) and its implications for attribution.

Didn't come to VB2017? Tell us why!

Virus Bulletin is a company - and a conference - with a mission: to further the research in and facilitate the fight against digital threats. To help us in this mission, we want to hear from those who didn't come to Madrid. What is your impression of…

Montreal will host VB2018

Last week, we announced the full details of VB2018, which will take place 3-5 October 2018 at the Fairmont The Queen Elizabeth hotel in Montreal, Quebec, Canada.

VB2017 preview: Beyond lexical and PDNS (guest blog)

In a special guest blog post, VB2017 Silver sponsor Cisco Umbrella writes about a paper that researchers Dhia Mahjoub and David Rodriguez will present at the conference this Friday.

Avast to present technical details of CCleaner hack at VB2017

The recently discovered malicious CCleaner version has become one of the biggest security stories of 2017. Two researchers from Avast, the company that had recently acquired CCleaner developer Piriform, will share the results of their investigations…