Research: PGP Tools Still Unsuitable For The Masses

PGP tools for encrypting e-mail messages have been around for years, but are still unsuitable for the masses to use. Researchers at Brigham Young University concluded on the basis of own research (pdf).


For their research they let subjects Mailvelope try a browser extension for encrypting webmail. The reason was for Mailvelope chosen was that it is the only solution that is named by the American civil rights movement EFF and existing webmail services can handle. Also gets positive reactions in the Chrome Web Store. At the trial, 20 participants took part, divided into 10 pairs. The participants were instructed to Mailvelope encrypted via e-mail each other within one hour. Only one pair of pressed herein.

"This shows that the encryption of e-mail using PGP, as implemented in Mailvelope still unsuitable for the masses," according to the researchers. The most common mistake during the study was to encrypt a message using the public key of the sender. Something happened seven couples, including the couple finally did manage to send an encrypted message.Furthermore, three pairs generated a key pair "with information from their friends, and then tried to use public key to encrypt their message.

Improvement

Despite the criticism, the researchers also show improvement. They advocated for integrated tutorials to guide new users.Furthermore, a simple explanation of cryptography via public keys help users to manage their own keys well and could offer PGP-based tools to automatically for unknown recipients to generate an e-mail with the request to install the PGP software, a generate public key and share it with the sender.

Destover malware signed with Sony certificate

It has been discovered a new variant of the dangerous malware attackers against Sony Pictures Entertainment have deployed and those with a digital certificate of the company is signed, so let researchers know. It is the "Destover" malware, which also last year against South Korean banks and television companies was used. On infected computers malware steals data and then removes all files, making the machines currently unusable.

During the attack on Sony, the attackers have the private keys captured and published that the company used to provide files of a digital certificate. However, they can also be used to sign malware, and then be used in further attacks, let anti-virus firm Kaspersky Lab know. They discovered Destover variant was signed on 5 December. Because Sony certificates are trusted by security makes this attack effectively. The digital certificate has been revoked, let certificate authority DigiCert via Twitter know.

Security Researcher Colin Keigher leave via Twitter that this is a "joke" among security researchers. A researcher who requested anonymity had found the certificate and discovered that it was the password file. Then this investigator signed the Destover malware with the Sony certificate and uploaded it to VirusTotal, which eventually landed at Kaspersky Lab.

SONY - Malware Analysis

The malware was used recently against Sony is the same " destructive "malware that the FBI this week warned. Reported that the Japanese anti-virus company Trend Micro that a copy of the malware got hold. The main part of the malware is a collection of user names and passwords to be logged on shared network drives.

Once active users remove the malware files and files connected network drives and stops the Microsoft Exchange Information Store service. Then the malware two hour idle and then restart the system. Another part of the malware puts a .bmp file on the computer that contains the message "Hacked by #GOP". This is the same image that would have appeared on the computers from Sony. Trend Micro therefore proposes that the malware that was used against Sony.

Here is Deep Analysis of Destructive Malware By Some Security Research Companies:

Trend Mirco
Kaspersky
Symantec
BlueCoat

VirusTotal Link:
https://www.virustotal.com/en/file/4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9/analysis/1417763962/