A critical flaw in the popular encryption software GNU Privacy Guard (GPG) allows attackers to launch a phishing-style attack that inserts text appearing to part of a trusted email, Core Security Technologies announced today.
The vulnerability, which has been patched since Feb. 20 and is corrected in the new version of GPG that was released Monday, affects email clients such as KMail, Evolution, Sylpheed, Mutt and GNUMail, said Arce.
He said there have been no reports of active exploits, but an attack is particularly worrisome because it would allow cybercriminals to use a new vector.
"The attacker can insert text in what you believe is a completely signed [encrypted] message," said Mike Yaffe, Core’s marketing director. "You insert code and say, ‘Hey go to this website,' or, 'hey, take this action.’ [The victim]has every reason to believe it’s a legitimate email."
Click here to email reporter Dan Kaplan.