Cryptography Assignment: Discussion On Security Attacks

Question

Task: This assessment asks you to apply what you have learnt on the module to two recently discovered, very high-profile vulnerabilities, are commonly referred to as E-FAIL (original paper here: https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak) and KRACK (original paper here: https://papers.mathyvanhoef.com/ccs2017.pdf). Answer the following questions in part a for E-FAIL, and part b for KRACK. I expect answers is 8 pages in total.

Question 1: Research each attack and explain the cryptographic weaknesses that make the attack possible, and explain how the attack is performed.

Question 2: Explain what can be done with the E-FAIL and KRACK attacks? What do each of them allow an attacker to do, and what kind of access does the attacker need?

Question 3: Assume you have been asked by a business to assess the risks these attacks pose to them. Write some advice for the business. Can the business know if the attacks were used against them? State what the impact of the attacks might have been and what the business should do.

Answer

Introduction
There are numerous security attacks explored in the segments of cryptography assignment that have been developed and some of these attacks use cryptographic weaknesses to get executed. Two such attacks as e-fail and KRACK attacks are discussed in the cryptography assignment. A detailed description of the attack mechanism will be discussed within the cryptography assignment. Furthermore, the report will talk about how exactly the attack works. Then the report on cryptography assignment goes on to explain the control measures along with security guidelines a businesses can follow to help prevent from these and possible similar attacks in the future.

Answer 1
E-Fail Attacks: Emails are the most common forms of web communications that are used in the present times. These emails are exposed to the cryptographic attacks and e-fail attacks are commonly seen. The emails are encrypted using the end-to-end encryption standards so that the information present in the mails does not get exposed or modified in an unauthorized manner. PGP and S/MIME are the two most popular encryption standards that are used.

There is a defined mechanism that is followed to exploit the vulnerabilities and give shape to these attacks. The email clients are mostly configured in such a manner that the automated decryption of the email contents is performed. However, in the case of the client configuration wherein the external resources may also be automatically loaded, the malicious entities can misuse the behavior and steal the content in the plaintext form by sharing the modified version of the email. As per the information considered to prepare this cryptography assignment, the plaintext will be injected to the encrypted mail and the exploit will be utilized when the recipient accesses the mail. To perform the e-fail attacks, it becomes essential for the malicious entities to have access to the encrypted mails. These mails are then modified and resent to the user to trick the email client and the secret message is revealed without alerting the user (Poddebniak et al., 2018). The use of an encrypted message received by the user is done to convert the same to multi-part HTML emails and the forging of the recipient address is done as well. This tricks the user and the user believes that the message arrives from the original entity. The email message that is composed by the attacker also includes the unclosed image tag before the encrypted message and the message ends with the tag close. As soon as the targeted client gets the message, the decryption process begins and the automatic rendering of the HTML content is performed. The email client sends the requests to load the image and the attacker captures the request in the process. The filename includes the complete content of the original mail in the plaintext form which can be easily accessed by the malicious entity. PGP is the encryption standard that generates a warning to the email client in the case of violation of integrity. However, there are a number of email clients that do not display any of these warnings resulting in the successful occurrence of the e-fail attacks.

What is the role of KRACK Attack in the context of cryptography assignment?
KRACK is the abbreviation for Key Reinstallation Attacks and these are the cryptographic attacks that utilize the vulnerability present in WPA2. The attacks are carried out to steal/acquire the information shared on the network channels. The KRACK attacks can also be used by the attackers to carry out the eavesdropping and man in the middle attacks.

The 4-way handshake is the primary mechanism which is used to carry out the KRACK attacks. The same is explained in the steps below.

• The first step illustrated in the cryptography assignment involves the channel-based man-in-the-middle attacks also involves initial handshake messages.
  • The adversary in this cases clines the access point (AP) on some another channel. For instance, the real AP may be on channel 4, whereas channel 2 will be utilized for the purpose of cloning (Vanhoef & Piessens, 2017).
  • The use of Channel Switch Announcements is done so that the victims are forced to connect with the cloned AP present on channel 2.
  • The forwarding of the initial 3 messages of the 4-way handshake is carried out between the client and the AP.
  • As soon as the client gets the third message of the handshake process, the installation of the new session key is done (PTK).
• The second steps involved the trigger to reinstall a key
  • The fourth message of the handshake is not forwarded to the AP and the situation of a blockage is created.
  • The AP retransmits the previous message that is the third message to the client.
  • The client provides the response in the form of the fourth message. As a common practice, the clients carry out the encryption of the message that is retransmitted at the link layer.
  • The client reinstalls the session key which results in the resetting of transmit nonce to 0.
• The third step mentioned in the cryptography assignment includes the abuse to nonce reuse.
  • Now the client transmits the normal encrypted data frame and it will increment the nonce counter in this case. Also, the reuse of the nonce value 1 will be done during the encryption process.
  • The keystream involved can be derived from the encrypted retransmitted message 4 and the utilization of the same is done for the purpose of decryption.
  • The rest of the packets that are predicted, such as HTML, ARP, etc. are utilized to access the known plaintext and the keystream. This is then utilized to decrypt further for the larger packets.

Answer 2
There are some of the countermeasures as listed herein cryptography assignment that can be adopted to avoid and prevent the E-fail and KRACK attacks. To avoid and deal with the E-Fail attacks the following steps may be taken.

• Short-term steps and measures:
  • There shall be no decryption in the email client. The decryption of the PGP and S/MIME mails shall be performed in the separate application that shall be external to the email client. This will prevent the email clients from opening the exfiltration channels.
  • The HTML rendering shall be disabled. The most common way of executing the e-fail attacks is by abusing the active HTML content that may be in the form of an image or message, and likewise. With the disabling of the HTML rendering, the most common way of carrying out the attack will be prevented (Goodin, 2018).
• Mid/Long term measures:
  • Patching and regular updates shall be performed to deal with the vulnerabilities that give shape to the e-fail attacks.
  • The S/MIME and PGP standards shall be updated to provide protection against the e-fail attacks. The standards cannot be updated in a single day and therefore, it will be a long-term process to carry out the updates.

The measures to prevent and avoid the KRACK attacks are listed below within the cryptography assignment:

• The updates on the implementations shall be carried out so that the KRACK attacks can be prevented in a backwards-compatible way.
• The involvement of access point in preventing and avoiding the KRACK attacks can be crucial. The message 3 involves in the 4-way handshake shall not be retransmitted. The similar process can be used in the group-key handshake mechanisms. The first message in the process of group-key handshake shall not be retransmitted which can lead to the prevented of the attack. The use of the EAPOL-Key replay counter can be done instead for the purpose of retransmitting the message. (Kohlios & Hayajneh, 2018)

The KRACK vulnerability highlighted in this section of cryptography assignment was identified by the researchers before the malicious entities could utilize and exploit the same. This resulted in the release and installation of the patches by the majority of the operating systems to avoid the KRACK attacks. There are additional security measures that can be followed to avoid these attacks. These are the basic measures which can be easily identified by the users. For instance, during browsing on the web, the users shall ensure that they browse over HTTPS in the place of HTTP. This will add an additional layer of security and will make it difficult for the attackers to give shape to the KRACK attacks (Zhang & Ma, 2019).

The e-fail attacks provide the attackers with the ability to get access to the encrypted emails. These encrypted emails can be accessed by the attackers as plaintext and the critical information shared on the mails can then be misused by the attackers. For instance, a user may share the demographic details on the email which can be captured by the attacker and the user may be targeted utilizing the same. To perform the e-fail attacks, it becomes essential for the malicious entities to have access to the encrypted mails. These mails are then modified and resent to the user to trick the email client and the secret message is revealed without alerting the user (Samuel, 2018).

In the case of the KRACK attacks explored in the cryptography assignment, the attacker can capture the information being shared over the networking channels in an unauthorized manner. There is a lot of sensitive information that may be shared over the emails, such as financial details, demographic details, and likewise which may be captured and misused by the attackers by giving shape to the KRACK attacks. The network access is required by the attacker to carry out these attacks.

Answer 3
There are some of the basic to advanced security measures outlined in this segment of cryptography assignment that the business can adopt to make sure that the e-fail and KRACK attacks do not take place. There must be no decryption in the email client. The decryption of the PGP and S/MIME mails must be performed in the separate application that will be external to the email client. This will prevent the email clients from opening the exfiltration channels. The HTML rendering will be disabled. The most common way of executing the e-fail attacks is by abusing the active HTML content that might be as an image or message, and likewise (Newcomb, 2017). With the handicapping of the HTML rendering, the most common way of doing the attack will be prevented. Patching and regular updates will be performed to deal with the vulnerabilities that give shape to the e-fail attacks. The updates on the implementations will be carried out with the goal that the KRACK attacks can be prevented in a backwards-compatible way. The involvement of access point in preventing and evading the KRACK attacks can be urgent. The message 3 involves in the 4-way handshake will not be retransmitted (Buckbee, 2017). The comparative process can be used in the group-key handshake mechanisms.

The businesses shall also ensure that the network security tools are in place. The installation of the security packages, such as anti-malware and anti-denial tools shall be done by the business. It shall train its employees and the stakeholders to follow the basic security practices, such as prevention of unauthorized information sharing, use of HTTPS while browsing over the web, accessing the critical applications on the private networks, and likewise. Also, the employees shall be trained on avoiding sharing the critical details over the email channels. As per the research carried on the cryptography assignment, the network security shall be upgraded by the installation of network scanners and the use of hardware, software, and network firewalls. The intrusion detection and prevention systems shall be used as well (Michael, 2017).

The business can determine if the e-fail or KRACK attacks were executed and used against them. The scanning of the network logs and the system activity logs can be done for this purpose. The integrity checks and audits can be performed to determine the attack occurrence. PGP also issues a warning if there are any of the integrity violations. The business may check such warnings issued in the past. This will provide the business with the information of the attack occurrence and will also assist it in the determination of the measures that shall be used to prevent the attacks in the future (Peltier, 2015).

The occurrence of these security attacks can have severe impacts on the business. The e-fail and KRACK attacks will allow the malicious entities to capture the critical and sensitive information about the customers associated with the business organization, employee data, and the internal business information. The information may be transferred to the competitor that may misuse the same against the attacker (Keung, 2016). As stated in the cryptography assignment, it is also possible that the information is misused, such as the financial details of the customers are modified or accessed. The impacts can result in the deterioration of the customer satisfaction and engagement scores and the breakout of the attack details in public can lead to the deterioration of the brand value in the market. It may also lead to the legal obligations and punishments for the business firm if the customer data is captured and misused. The business shall adopt the security measures that have been stated earlier and must conduct security audits and reviews on a regular basis to make sure that such occurrences do not take place (Pathari & Sonar, 2015).

Conclusion
The security attacks as e-fail and KRACK attacks occur largely because of the security vulnerabilities. It is concluded from the above discussion on cryptography assignment that it is necessary that these attacks are controlled and the regular security updates must be done. The attacks shall also be controlled by using the technical and administrative measures to improve the security.

References
Goodin, D. (2018, May 14). Decade-old Efail flaws can leak plaintext of PGP- and S/MIME-encrypted emails. Retrieved March 4, 2020, from Ars Technica website: https://arstechnica.com/information-technology/2018/05/decade-old-efail-attack-can-decrypt-previously-obtained-encrypted-e-mails/

Keung, Y. H. (2016). Information Security Controls. Advances in Robotics & Automation, 03(02). https://doi.org/10.4172/2168-9695.1000e118‌

Kohlios, C., & Hayajneh, T. (2018). A Comprehensive Attack Flow Model and Security Analysis for Wi-Fi and WPA3. Cryptography assignment Electronics, 7(11), 284. https://doi.org/10.3390/electronics7110284

Michael, K. (2017). Securing the Cloud: Cloud Computer Security Techniques and Tactics. Computers & Security, 31(4), 633. https://doi.org/10.1016/j.cose.2012.03.006

Pathari, V., & Sonar, R. (2015). Identifying linkages between statements in information security policy, procedures and controls. Information Management & Computer Security, 20(4), 264–280. https://doi.org/10.1108/09685221211267648‌

Peltier, T. R. (2015). Information security fundamentals. Crc Press, Taylor & Francis Group.‌

Poddebniak, D., Dresen, C., Muller, J., Ising, F., Schinzel, S., Friedberger, S., … Schwenk, J. (2018). Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels.

Samuel. (2018, May 14). Here’s How eFail Attack Against PGP and S/MIME Encrypted Emails Works. CyberSecurity Training in Namibia and Africa. Retrieved from https://cybersafe.mcttrainingconsultant.com/securityattack/heres-how-efail-attack-against-pgp-and-s-mime-encrypted-emails-works/

Vanhoef, M., & Piessens, F. (2017). Key Reinstallation Attacks. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security - CCS ’17. https://doi.org/10.1145/3133956.3134027

Zhang, L., & Ma, M. (2019). Secure and efficient scheme for fast initial link setup against key reinstallation attacks in IEEE 802.11ah networks. Cryptography assignment International Journal of Communication Systems, 33(2), e4192. https://doi.org/10.1002/dac.4192