Will Email Ever Be Truly Secure?
Email gateways are a leading cause of security breaches. The optimistic view is that effective email security practices, firewalls, mobile device security, wireless security, endpoint security, web security, behavioral best practices, data loss prevention and network access control – among other solutions – can ensure foolproof security. The realistic view is that email – or anything for that matter – cannot be truly secure.
To err is human. Technology advancement is a boon and a bane: cyber attacks are more sophisticated than before. You can trust no one security solution, place your full trust on end-to-end encryption (currently the most secure way to communicate securely and privately online) or predict when someone will break into your device and access your email.
The road to HIPAA compliance is paved with many risks, possibilities and outcomes. Well-researched and thoughtful implementations are essential but there are many decisions to make and loose ends to tie up. Your ePHI protection, privacy and confidentiality practices may be excellent, but your employees may still mistakenly dispose of a fax machine or hard drive that contains retrievable PHI. Or some of your staff may fail to observe the policy of what needs to be encrypted and what does not.
And if you thought that email encryption, cryptographic protocols and even your computer system and CPU were protecting your data at all times, think again…
Efail
The two widely-used methods of email encryption – S/MIME and PGP – are vulnerable to attack. The weakness – known as Efail – allows hackers to expose the plaintext version of encrypted email content under certain conditions. For the weakness to be exploited, hackers should first have to intercept encrypted email. Once this is achieved, hackers manipulate the message’s HTML elements. When the recipient receiving the altered message decrypts it, the email loads the manipulated components and gives hackers access to the plaintext version of the message.
The cryptography community is divided on how best to handle the issue: whether the fault lies with PGP and S/MIME ecosystems or email clients. Many email clients and WebMail systems are vulnerable; many never were or have since patched themselves against this recent security discovery.
Evolving TLS
The TLS protocol evolved from the SSL protocol developed in the 1990s. SSL/TLS protocols have faced attacks since, ranging from BREACH, FREAK and Sweet32 to triple handshake, ‘goto fail’ and Heartbleed. Subsequent evolutions of the protocols factored in these attacks and led to the development of TLS 1.3, which disallows cryptographic techniques deemed weak and exploitable, including hash functions (SHA-1, MD5), stream ciphers (RC4), block ciphers (3DES) and more.
Although TLS 1.3 is a massive improvement from earlier versions, it is no silver bullet and it will be a years before its use is pervasive. Security is multi-dimensional in nature. Even the most secure solution does not guarantee that attacks will be wiped out: the way the protocol is implemented and how well implementations of the protocol are configured and used, matter too.
Spectre and Meltdown
Turns out modern CPUs have grave design flaws. Case in point: the two recently discovered threats dubbed Spectre and Meltdown. These are basically hardware bugs that attackers can use to manipulate a processor to steal information from the memory of other programs. An Intel CPU infected with Meltdown makes it possible for normal applications to read kernel memory, giving access to passwords and other sensitive information. Spectre tricks the processor into starting speculative execution – a technique where the computer system performs a task that may not be needed – to access protected memory and steal data.
MS secure boot loaders
Boot loaders are a common attack vector for techniques such as rootkits that bypass the boot loader to launch malware. Traditional anti-malware tools often fail to remove the infection from such attacks. The PC industry developed the Secure Boot security standard to address this issue wherein the firmware checks the signature of boot software and hands control to the operating system only if the signatures are valid.
Microsoft has been using the Secure Boot option since Windows 8, but somewhere along the line, the company created an internal debugging tool, which hackers can recover from customer hardware. The problem the policy creates is that computers will only check the file for signature rather than authenticate the OS. This means, hypothetically at least, it is possible to load non-Microsoft software, creating the risk that the secure boot system can be bypassed, allowing an attacker to directly infect a computer in his/her possession.
Attacks on basic cryptographic standards
That collision attacks could break into SHA-1 was discovered back in 2005, the attack method was published in 2011 and six years later, the first case of running the attack made a strong statement. Algorithms such as SHA-1 (although not SHA-3), MD5 and SHA-2 are susceptible to a length extension attack, where attackers create their own signed message without knowing the secret key.
The RC4 algorithm used in SSL/TLS has single byte biases that create opportunities for plaintext recovery attacks. Meanwhile, SSL 3.0 – the now deprecated web encryption standard – has a severe security vulnerability that can be exploited to steal sensitive data. Known as POODLE (Padding Oracle On Downgraded Legacy Encryption), the vulnerability allows a man-in-the-middle attacker to decrypt HTTP cookies containing website preferences, passwords and personal information.
Nothing can be fully secure, but it can be ‘secure enough’
100% security is wishful thinking. Security threats loom from unscrupulous elements, hacktivists, foreign governments and our own intelligent agencies. The best that businesses can do – and must do – is to implement safety measures that reduce risk of damage and the exposure to new attack vectors. Advances in cybersecurity technologies and viable device security best practices make it possible to deter chances of or lower the intensity of various attack mechanisms. Proactive and smart security implementations will ultimately go a long way in securing public goodwill and avoiding hefty financial penalties if or when security incidents eventually occur.
Want to discuss how LuxSci’s HIPAA-Compliant Email Solutions can help your organization? Contact Us
