Am 12.08.19 um 17:47 schrieb Stefan Claas via Gnupg-users: > Sebastian Schinzel wrote: > >> Dear all, >> >> Jens Müller just gave a talk at DEFCON about Covert Content Attacks >> against S/MIME and OpenPGP encryption and digital signatures in the >> email context. He just published the PoC emails that he used in the talk >> and they might be useful for further testing. >> >> https://github.com/RUB-NDS/Covert-Content-Attacks >> >> This is the paper describing the attacks from April 2019: >> >> https://arxiv.org/abs/1904.07550 > > Thanks for the info. I do no longer use a GPG plug-in MUA > combination, but are these 'Johnny you are fired' issues > already been resolved? I must admit I am a bit out of the > loop.
Those are two different papers. 1. The 'Jonny, you are fired' paper solely dealt with signature spoofing and the repo is here: https://github.com/RUB-NDS/Johnny-You-Are-Fired 2. The paper mentioned in the thread above is 'Re: What's Up Johnny? -- Covert Content Attacks on Email End-to-End Encryption' and it contains some leftover attack cases that didn't make it into the Efail paper. It aims at exfiltrating the plaintext of encrypted mails, but with some degree of user interaction, e.g. replying to a malicious email. Lots of test cases and I am not aware of any current list of what MUA fixed which issue (correctly or incorrectly). Best, Sebastian _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
