Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
Two new vulnerabilities have been discovered impacting multiple email clients. The vulnerabilities impact customers that use OpenPGP or S/MIME to secure email communications. Successful exploitation may allow threat actors to decrypt sensitive email communications when the victim is using a vulnerable email client or plugin. Threat actors combine known weaknesses in the encryption algorithms with automatic rendering of active content to perform this new attack. Threat actors first need to obtain the encrypted messages, then send them to a user with a vulnerable email client.
For a full list of affected email clients, please see the official EFAIL whitepaper1.
There are two techniques for exploiting EFAIL. The first being direct exfiltration which affects both PGP and S/MIME. In this scenario, the adversary intercepts an encrypted email and places it into a new email with HTML tags around the encrypted section. This new email is then sent to the victim. When received by the victim’s mail client, the message is unencrypted, but the additional HTML tags cause a misinterpretation of data, sending the unencrypted message to a remote server where it can be read.
The second technique is the modification of ciphertext using known weaknesses in the Cipher Block Chaining. Since threat actors know the structure of S/MIME emails, they can perform a plaintext attack and embed HTML tags, similar to the first technique.
CVE-2017-176882 and CVE-2017-176893 have been reserved for the PGP and S/MIME vulnerabilities; at this time, the CVE references have not been updated with current information.
References:
[1] Efail: Breaking S/MIME and OpenPGP Email Encryption
https://efail.de/efail-attack-paper.pdf
[2] CVE-2017-17688
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-17688
[3] CVE-2017-17689
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-17689