Weak cryptography keys allow others to add valid DKIM signatures to fake emails

Posted by   Virus Bulletin on   Oct 25, 2012

512-bit key cracked within 72 hours.

A Florida-based mathematician has caused a stir in the email community by adding a valid DKIM signature for google.com to an email after cracking the company's private signing-key.

When the first SMTP standard was published just over three decades ago, email spam barely existed. The email landscape has changed beyond recognition since 1982, and various enhancements have been introduced to help tackle the problem of correctly filtering thousands or even millions of emails per day. DKIM (DomainKeys Identified Mail), which has gained momentum in recent years, is one such feature.

DKIM - which is easily and commonly misunderstood - adds a domain-based digital signature to an email. A valid DKIM signature does not mean the message is not spam, nor does it make any claims about the verity of the content or headers of the email. A valid DKIM signature merely says that the message passed through the mail servers of the signing domain.

Yet in this apparent weakness also lies DKIM's strength: unlike any other part of the email (bar the sending IP address), you can be certain that this domain is not forged. Hence you can use this fact to increase the spam-probability for one domain that is known to send a lot of spam, decrease it for another that you trust to filter outbound email, and make sure you never mark emails from a third, highly trusted, domain as spam.

If, for instance, you believe that Google doesn't mess things up internally, you can be sure that an email claiming to come from larry@google.com with a valid DKIM signature for google.com was indeed sent by Google co-founder Larry Page.

But, like so many applications of cryptography, the sound mathematics behind DKIM has little value when the implementation is poor.

Zachary Harris, a Florida-based mathematician, recently discovered that Google was using a 512-bit DKIM key. Without having prior knowledge of DKIM, it took him 72 hours to crack the key and thus he was able to sign a faked message from Larry Page to his fellow co-founder Sergey Brin. Harris did not receive any response to this email, but Google did replace its key with a 2048-bit one.

Google isn't the only high-profile organization to have used a weak key: eBay, Yahoo, Twitter and Amazon all used 512-bit keys, while PayPal, LinkedIn, US Bank and HSBC used keys that were 768 bits long - still too weak for companies that are heavily phished.

After having been contacted by Harris, most companies fixed their keys - though after a few failed to do so, he decided to contact US-CERT and go public with his discovery. A US-CERT announcement can be found here.

DKIM will not solve the spam problem (nor does it claim to do so), but it does add an extra layer of trust to email. With the increase in targeted attacks we have seen recently - the people behind which would generally think nothing of spending 72 hours and an apparent US$75 to crack a key - its importance is likely to increase and thus it is a good thing that DKIM is applied by most major email senders these days. But if they sign their emails with weak keys, they would perhaps do better not to sign them at all.

More at Wired here.

Posted on 25 October 2012 by Martijn Grooten



Latest posts:

VB2016 paper: The TAO of Automated Iframe Injectors - Building Drive-by Platforms For Fun

We publish Aditya K. Sood's VB2016 paper on the use of iframe injectors by cybercriminals to deliver drive-by downloads.

“Cybersecurity is, at its core, a people problem,” says VB2016 keynote speaker

An interview with VB2016’s keynote speaker Christine Whalley - Director, Governance and IT Risk Management at Pfizer

Throwback Thursday: Following the Breadcrumbs

In 1999, Christine Orshesky described how one large organization decided to find out how and where the viruses within it were being obtained so it could do more to protect its networks.

VB2016 preview: Cryptography mistakes in malware

At VB2016, two talks will discuss mistakes made by malware authors in cryptographic implementations. Ben Herzog and Yaniv Balmas will present a paper in which they look at a number of these mistakes, while Malwarebytes researcher hasherezade will…

GPS technology is more at risk from cyber attack than ever before, security expert demonstrates at VB2016

Next month at VB2016, HPE Security's Oleg Petrovsky will speak about attacks on GPS. We conducted a short interview with Oleg and asked him about GPS, about the conference, and about his ultimate dinner party.