Weak crypto allowed spoofing emails from Google, PayPal domains

Zach Harris, a Florida-based mathematician, discovered that Google and many other big Internet companies use weak cryptographic keys for certifying the emails sent from their corporate domains – a weakness that can easily be exploited by spammers and phishers to deliver emails that, for all intents and purposes, look like they were sent by the companies in question.

According to Wired, he discovered that almost by chance after receiving an email from a Google job recruiter. Doubting its authenticity, he checked the e-mail’s header information, and it seemed legitimate.

But he also noticed that the DomainKeys Identified Mail key the company uses for the google.com e-mails was only 512 bits long and, therefore, crackable within days with the help of cloud computing.

Believing this to be a recruiting test that all who want to be considered for the job must pass, he decided to crack the key and use it send emails to Google’s two founders, making it seem to each of them like it was coming from the other but also including his email address in the return path.

Having received no reply in the next few days from either of them or from the recruiter that first contacted him, he began to doubt his initial impression and went to check Google’s cryptographic key.

He then discovered that it had been changed to the standard length, leading him to conclude that Google had not, obviously, been aware of this vulnerability until the moment they received those emails.

His interest piqued, he poked around to check whether other popular firms, online services and social networks were vulnerable to the same attack, and discovered that PayPal, eBay, Apple, Amazon, Twitter, and many other companies – including several banks – were using 384 bits, 512 bits, or 768 bits keys.

The good news is that since his discovery he contacted all of those companies with this information and most have already issued new keys for the domains and revoked the old ones, in order to thwart potential phishers.

The bad news is that he found a similar flaw in the receiving domains, which often accept test DKIM keys, verifying the emails as legitimate instead of as unsigned.

UPDATE:
US-CERT has issued a warning about the issue, advising sysadmins to check the length of DKIM keys, to replace them (if needed) with 1024 bit or longer keys (particularly for long-lived keys), and to configure their systems to not use or allow testing mode on production servers.