Feeds

PGP Vuln exposed by Outlook plug-In

Pretty Poor Privacy?

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

ComputerWire: IT Industry Intelligence

One the most important secure email standards used to encrypt messages could be vulnerable to attack through a plug-in used by the Microsoft Outlook email suite.

It is claimed that certain commercial and freeware products supplied by Network Associates Inc that use the Pretty Good Privacy encryption standard contain a flaw that could leave systems exposed.

From the hole in a PGP-encrypted messaging plug-in, a hacker might launch keystroke-logging software to unscramble confidential email messages. Investigations by Aliso Viejo, California-based eEye Digital Security Inc suggest that Network Associates' PGP Desktop Security 7.0.4, PGP Personal Security 7.0.3 and PGP Freeware 7.0.3 products are susceptible.

PGP, which was originally developed by renowned cryptographer Phil Zimmerman and is now owned by Network Associates, can be called a standard simply through the size of its market share. PGP is widely deployed and has penetrated the market because of its non-hierarchical "web of trust" model.

The Santa Clara, California-based company has issued a patch, but insists the flaw does not affect the PGP encryption software itself, but the PGP plug-in for Outlook.

It is not the first time PGP has looked vulnerable to hackers. Last year it emerged that under certain circumstances, PGP v5.0 generates keys that are not sufficiently random, which could allow an attacker to predict keys to recover information encrypted with that key.

© ComputerWire

Internet Security Threat Report 2014

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.