EFAIL was a set of attacks disclosed on 13 May 2018 by security researchers Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jörg Schwenk. The researchers documented two vulnerabilities, CVE-2017-17688 and CVE-2017-17689, affecting email clients that processed encrypted OpenPGP or S/MIME messages alongside active HTML content or externally loaded resources. An attacker needed access to an encrypted message and the ability to send a modified version to one of its recipients.
By inserting crafted MIME structure or exploiting weaknesses in CBC and CFB message handling, an attacker could cause a vulnerable client to decrypt the message and place its plaintext inside an HTML element, such as an image URL. The client could then transmit the plaintext to an attacker-controlled server, without exposing the encryption keys. The issue was primarily a failure of email-client processing and configuration rather than a direct defeat of the underlying cryptography. Countermeasures included disabling active content and external resource loading, while the Electronic Frontier Foundation recommended stopping use of PGP plugins during the disclosure. The incident prompted criticism of the disclosure process and calls for better coordinated handling of future OpenPGP security reports.
