Weak cryptography keys allow others to add valid DKIM signatures to fake emails

Posted by   Virus Bulletin on   Oct 25, 2012

512-bit key cracked within 72 hours.

A Florida-based mathematician has caused a stir in the email community by adding a valid DKIM signature for google.com to an email after cracking the company's private signing-key.

When the first SMTP standard was published just over three decades ago, email spam barely existed. The email landscape has changed beyond recognition since 1982, and various enhancements have been introduced to help tackle the problem of correctly filtering thousands or even millions of emails per day. DKIM (DomainKeys Identified Mail), which has gained momentum in recent years, is one such feature.

DKIM - which is easily and commonly misunderstood - adds a domain-based digital signature to an email. A valid DKIM signature does not mean the message is not spam, nor does it make any claims about the verity of the content or headers of the email. A valid DKIM signature merely says that the message passed through the mail servers of the signing domain.

Yet in this apparent weakness also lies DKIM's strength: unlike any other part of the email (bar the sending IP address), you can be certain that this domain is not forged. Hence you can use this fact to increase the spam-probability for one domain that is known to send a lot of spam, decrease it for another that you trust to filter outbound email, and make sure you never mark emails from a third, highly trusted, domain as spam.

If, for instance, you believe that Google doesn't mess things up internally, you can be sure that an email claiming to come from larry@google.com with a valid DKIM signature for google.com was indeed sent by Google co-founder Larry Page.

But, like so many applications of cryptography, the sound mathematics behind DKIM has little value when the implementation is poor.

Zachary Harris, a Florida-based mathematician, recently discovered that Google was using a 512-bit DKIM key. Without having prior knowledge of DKIM, it took him 72 hours to crack the key and thus he was able to sign a faked message from Larry Page to his fellow co-founder Sergey Brin. Harris did not receive any response to this email, but Google did replace its key with a 2048-bit one.

Google isn't the only high-profile organization to have used a weak key: eBay, Yahoo, Twitter and Amazon all used 512-bit keys, while PayPal, LinkedIn, US Bank and HSBC used keys that were 768 bits long - still too weak for companies that are heavily phished.

After having been contacted by Harris, most companies fixed their keys - though after a few failed to do so, he decided to contact US-CERT and go public with his discovery. A US-CERT announcement can be found here.

DKIM will not solve the spam problem (nor does it claim to do so), but it does add an extra layer of trust to email. With the increase in targeted attacks we have seen recently - the people behind which would generally think nothing of spending 72 hours and an apparent US$75 to crack a key - its importance is likely to increase and thus it is a good thing that DKIM is applied by most major email senders these days. But if they sign their emails with weak keys, they would perhaps do better not to sign them at all.

More at Wired here.

Posted on 25 October 2012 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2018 paper: Lazarus Group: a mahjong game played with different sets of tiles

The Lazarus Group, generally linked to the North Korean government, is one of the most notorious threat groups seen in recent years. At VB2018 ESET researchers Peter Kálnai and Michal Poslušný presented a paper looking at the group's various…

Book your VB2019 ticket now for a chance to win a ticket for BSides London

Virus Bulletin is proud to sponsor this year's BSides London conference, which will take place next week, and we have a number of tickets to give away.

First 11 partners of VB2019 announced

We are excited to announce the first 11 companies to partner with VB2019, whose support will help ensure a great event.

VB2018 paper: Fake News, Inc.

A former reporter by profession, Andrew Brandt's curiosity was piqued when he came across what appeared at first glance to be the website of a small-town newspaper based in Illinois, but under scrutiny, things didn’t add up. At VB2018 he presented a…

Paper: Alternative communication channel over NTP

In a new paper published today, independent researcher Nikolaos Tsapakis writes about the possibilities of malware using NTP as a covert communication channel and how to stop this.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.