Feeds

US-CERT warns DKIM email open to spoofing

Mathematician accidentally spots flaw

Boost IT visibility and business value

US-CERT has issued a warning that DomainKeys Identified Mail (DKIM) verifiers that use low-grade encryption are open to being spoofed and need to be upgraded to combat attackers wielding contemporary quantities of computing power.

You might think this is no big deal – after all the value of strong cryptography has been recognized for years. Unfortunately this problem has been found to affect some of the biggest names in the tech industry, including Google, Microsoft, Amazon, PayPal and several large banks.

The DKIM system adds a signature file to messages that can be checked to ascertain the domain of the sender by checking with DNS. It also takes a cryptographic hash of the message, using the SHA-256 cryptographic hash and RSA public key encryption scheme, so it can't be altered en route.

The problem stems from the very weak key lengths that are being used by companies that should know better. To make matters more embarrassing the problem was spotted by complete accident by Floridian mathematician Zachary Harris, who used it to spoof an email to Google CEO Larry Page.

Harris told Wired that he received an email from a Google recruiter, asking him to interview with the company for a site-reliability engineering position. Smelling a rat, he looked at the email in more depth and saw that Google was only using a 512-bit key, which isn’t particularly secure these days.

"A 384-bit key I can factor on my laptop in 24 hours," he said. "The 512-bit keys I can factor in about 72 hours using Amazon Web Services for $75. And I did do a number of those."

Thinking the recruiter might have introduced the vulnerability as a creative test if he was suitable for the job, Harris used the flaw to spoof and email to Larry Page from fellow co-founder Sergey Brin, in which he plugged his own website as something worthy of attention. He got no response, but two days later noticed Google had upped its key length to 2,048 bits and he was suddenly getting a lot of IP hits from the Chocolate Factory.

After doing some digging around Harris discovered this was a surprisingly common problem. Amazon, Twitter, eBay and Yahoo! were all using 512-bit keys and even Paypal and banks like HSBC were still on 768-bit systems, despite the standard recommending at least 1,028-bit as a minimum.

"Those are not factorable by a normal person like me with my resources alone. But the government of Iran probably could, or a large group with sufficient computing resources could pull it off," he warned.

Harris contacted those companies he had found were vulnerable and most, but not all, upgraded their systems to much higher keys. He also contacted CERT Coordination Center at Carnegie Mellon University so an alert could be put out before he went public.

Upgrading key length isn't difficult, but companies also need to revoke the old ones and remove test keys from files. Some receiving domains are still accepting test keys that have never been revoked he said.

With spoofed emails an increasing problem you'd think something so simple could have been spotted earlier. The industry still has a lot of catching up to do it seems. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?