Proton

In late August, a security advisory(new window) was published regarding a newly discovered exploit affecting email providers. The issue, dubbed as “ROPEMAKER”, stands for “Remotely Originated Post-delivery Email Manipulation Attacks Keeping Email Risky”.

The attack is an interesting one so our security team took a closer look at it. The RopeMaker technique allows an attacker to visually modify a HTML email, sent by the attacker, even after it’s been delivered. In some cases, RopeMaker can also be used to modify the HTML code of an email as well. For example, an attacker could change a good link into a malicious link, or edit the body of an email at will, all without access to the mailbox, and even after the email has been delivered(new window).

Based on the security advisory, Outlook, Apple Mail, and Mozilla Thunderbird are/were vulnerable to this issue. Unfortunately, there’s no fix that you can make yourself to prevent this attack if you’re using one of these email applications. You’ll instead have to wait for these services to patch their systems.

How it Works

The main requirement for achieving a successful RopeMaker attack is when the email client allows remote CSS files to be rendered. The remote CSS file acts as a “modification backdoor” for the attacker/sender in the RopeMaker technique.

RopeMaker and Proton Mail

After analyzing the security advisory, we immediately performed an internal review of our CSS rendering processes. We can confirm that Proton Mail is not affected by the RopeMaker technique, and was not previously affected by it. However, we will be doing some additional development in order to further harden Proton Mail against future, not-yet-discovered exploits which may leverage some of the same techniques as RopeMaker.

At Proton Mail, we are serious about being the most secure email provider. A large part of ensuring a safe email experience is through engineering with security and privacy as the core principle, and not as merely an afterthought. However, even then, there is no such thing as 100% security, so providing the safest email service also requires active monitoring of the latest security threats to emerge.

As part of our email security efforts, our internal security team monitors numerous security mailing lists, forums, and other locations with relevant online chatter in order to identify and block threats before they can be exploited. In addition to our extensive internal efforts to protect Proton Mail users, we also host a bug bounty program to work with security researchers around the world in improving the security state of both Proton Mail and Proton VPN. Through leveraging the expertise of the global security community, we can ensure that Proton Mail is as safe as possible.

Related articles

Proton Drive for Windows new update with the Optimize Storage feature
en
We've added a new Optimize Storage feature in Proton Drive for Windows to manage synced folders easily. See more updates you may have missed.
en
  • Produktopdateringer
  • Proton Drive
Rebuilt from the ground up, the new Proton Drive for macOS app offers enhanced performance, improved reliability, and a refreshed design
The Earth, a recycling symbol, and a warning sign representing a reminder to back up data on World Backup Day
en
Celebrate World Backup Day by learning from data loss stories, from family heirlooms to $500,000 in Bitcoin, and how to avoid a similar fate.
A desktop computer showing cleanup supplies and Proton apps for digital cleaning
en
Take control of your digital life by spring cleaning your inbox, passwords, and cloud storage using Proton's suite of privacy-first tools.
What is ePHI? The difference between PHI and ePHI explained
en
What is the difference between ePHI and PHI, and how can healthcare data can optimally be kept safe as it’s passed from one party to another?
A vial, Erlenmeyer flask, and a DNA double-helix being deleted.
en
If you used 23andMe, your data could soon be for sale. Here's how to delete your data from 23andMe — and why you might want to do so sooner than later.