Weak cryptography keys allow others to add valid DKIM signatures to fake emails

Posted by   Virus Bulletin on   Oct 25, 2012

512-bit key cracked within 72 hours.

A Florida-based mathematician has caused a stir in the email community by adding a valid DKIM signature for google.com to an email after cracking the company's private signing-key.

When the first SMTP standard was published just over three decades ago, email spam barely existed. The email landscape has changed beyond recognition since 1982, and various enhancements have been introduced to help tackle the problem of correctly filtering thousands or even millions of emails per day. DKIM (DomainKeys Identified Mail), which has gained momentum in recent years, is one such feature.

DKIM - which is easily and commonly misunderstood - adds a domain-based digital signature to an email. A valid DKIM signature does not mean the message is not spam, nor does it make any claims about the verity of the content or headers of the email. A valid DKIM signature merely says that the message passed through the mail servers of the signing domain.

Yet in this apparent weakness also lies DKIM's strength: unlike any other part of the email (bar the sending IP address), you can be certain that this domain is not forged. Hence you can use this fact to increase the spam-probability for one domain that is known to send a lot of spam, decrease it for another that you trust to filter outbound email, and make sure you never mark emails from a third, highly trusted, domain as spam.

If, for instance, you believe that Google doesn't mess things up internally, you can be sure that an email claiming to come from larry@google.com with a valid DKIM signature for google.com was indeed sent by Google co-founder Larry Page.

But, like so many applications of cryptography, the sound mathematics behind DKIM has little value when the implementation is poor.

Zachary Harris, a Florida-based mathematician, recently discovered that Google was using a 512-bit DKIM key. Without having prior knowledge of DKIM, it took him 72 hours to crack the key and thus he was able to sign a faked message from Larry Page to his fellow co-founder Sergey Brin. Harris did not receive any response to this email, but Google did replace its key with a 2048-bit one.

Google isn't the only high-profile organization to have used a weak key: eBay, Yahoo, Twitter and Amazon all used 512-bit keys, while PayPal, LinkedIn, US Bank and HSBC used keys that were 768 bits long - still too weak for companies that are heavily phished.

After having been contacted by Harris, most companies fixed their keys - though after a few failed to do so, he decided to contact US-CERT and go public with his discovery. A US-CERT announcement can be found here.

DKIM will not solve the spam problem (nor does it claim to do so), but it does add an extra layer of trust to email. With the increase in targeted attacks we have seen recently - the people behind which would generally think nothing of spending 72 hours and an apparent US$75 to crack a key - its importance is likely to increase and thus it is a good thing that DKIM is applied by most major email senders these days. But if they sign their emails with weak keys, they would perhaps do better not to sign them at all.

More at Wired here.

Posted on 25 October 2012 by Martijn Grooten



Latest posts:

Security products and HTTPS: let's do it better

A recent paper showed that many HTTPS-intercepting security solutions have implemented TLS rather poorly. Does that mean we should avoid such solutions altogether?

The SHA-1 hashing algorithm has been 'shattered'

Researchers from Google and CWI Amsterdam have created the first known collision of the SHA-1 hashing algorithm, making a very strong case to ditch it.

Throwback Thursday: Once a researcher...

VB was saddened to learn this week of the passing of one of the pioneers of the AV industry, Ross Greenberg. This Throwback Thursday we look back at an interview with Ross in November 1995.

VB2017: What is happening in the threat landscape and what are we doing against it? Submit a proposal in the VB2017 CFP!

Have you analysed a new online threat? Do you know a new way to defend against such threats? Then submit an abstract in the CFP for VB2017!

VB2016 paper: APT reports and OPSEC evolution, or: these are not the APT reports you are looking for

APT reports are great for gaining an understanding of how advanced attack groups operate - however, they can also provide free QA for the threat actors. Today, we publish a VB2016 paper by Gadi Evron (Cymmetria) and Inbar Raz (Perimeter X), who…