Our Encrypted Email Service is Safe Against Linux TCP Vulnerability

Share this page

Proton Mail is not vulnerable to the recently announced Linux TCP Vulnerability

Earlier this week, a rather serious Linux TCP Vulnerability was disclosed (CVE-2016-5696(new window)) by security researchers in the US(new window). As a result, Proton Mail’s security team did an analysis of this bug to see if it compromises the integrity of Proton Mail’s encrypted email service. Our analysis shows that this bug did not pose a threat to users of our encrypted email service. Nevertheless, we have taken additional action to further harden Proton Mail’s servers.

Linux TCP Vulnerability

The vulnerability which was discovered has been present in the Linux kernel since 2012 and did impact the kernel version that Proton Mail is running. In order to exploit this vulnerability, an attacker only needs to have the IP addresses of the client and the server, which are not to difficult for a sophisticated attacker to obtain. Due to a rate limit enforced by Linux on TCP challenge ACK packets, it is possible to hijack the TCP connection between server and client. This can be used for example, to hijack HTTP (web) connections to insert malicious code and data into the communications stream.

More critically, this vulnerability can be exploited without needing to have man-in-the-middle (MITM) capabilities. Thus, the attack can also be performed “off-path” without the ability to eavesdrop on the network between server and client, significantly lowering the difficulty of the attack. Additional details can be found in the original research paper(new window).

Protecting our Encrypted Email Service

While this vulnerability sounds severe, its impacted on Proton Mail’s secure email service is quite limited because of the encryption that we utilize. In particular, we enforce HSTS on all of our web servers so all connections must go through HTTPS instead of HTTP. This means that during the period in which Proton Mail was vulnerable, the worst that could be done with this attack is to break the connection. The connection could not be hijacked or have malicious code inserted. You can learn more about HSTS from the following blog post made by Proton Mail Security Contributor Mazin Ahmed: Summary of HSTS Support in Modern Browsers

For your protection, Proton Mail uses Swiss SSL certificates with the highest strength ciphers. Our SSL certificates are issued by Swiss SSL certificate provider(new window) QuoVadis Trustlink Schweiz AG and in addition to HSTS, we also use Extended Validation (EV)(new window), 4096-bit RSA, SHA-256 hash, and Certificate Transparency (CT)(new window) with our SSL certificate. For security reasons, we utilize a very select group of SSL ciphers and use those with Perfect Forward Secrecy as often as possible.

SSL is only one security layer for securing our email service. Along with SSL, we also implement end-to-end encryption(new window) with PGP, and we are also the maintainers of OpenPGPjs, the world’s most widely used open source PGP library(new window). This combination of factors means that we are highly confident that no Proton Mail accounts were compromised as a result of this Linux TCP vulnerability.

Security Improvements

Because CVE-2016-5696(new window) has only just been reported, official security patches for the vulnerability have not yet been officially released upstream. However, we take a very proactive approach to security so our Security Team manually modified the running Linux kernel on all of our servers in order to make them immune to this security flaw. In order to make Proton Mail the world’s most secure email service, our team monitors security developments 24/7 so we can move quickly to mitigate any issues that may come up. For the additional security news and updates, you can also follow us on Twitter(new window).

Protect your privacy with Proton
Get a free account

Share this page

Proton Team

We are scientists, engineers, and specialists from around the world drawn together by a shared vision of protecting freedom and privacy online. Proton was born out of a desire to build an internet that puts people before profits, and we're working to create a world where everyone is in control of their digital lives.

Related articles

From having too many inboxes to manage to switching to a new email provider, there are many reasons why you’d want to delete your Gmail account. You might even be concerned that Google is abusing your privacy. Thankfully, you can delete your Gmail a
The first month of 2023 has brought brutal layoffs from Big Tech, a potential ban of TikTok in the US, and another Twitter breach. But the biggest development of this new year has to be the ascent of ChatGPT.  The chatbot can produce remarkably huma
Hackers were able to steal account details from over 200 million Twitter users and posted the database on a hacking forum in early January 2023. These details include users’ email addresses and Twitter handles, allowing people to potentially identify
From your online shopping receipts to financial statements, your emails contain a great deal of sensitive information about your life, interests, and daily schedule. If you’re concerned about your online privacy, it’s therefore vital to keep your inb
At Proton, we’re committed to building privacy-focused products that are convenient to use and improve your productivity. Last year, we released the new mobile apps for Proton Calendar and Proton Drive, letting you manage your schedule and upload imp
Most email services aren’t secure and limit attachment file sizes, but there are ways to send large files securely. If you’ve ever tried attaching multiple images or video files to an email, you’ll know that it doesn’t always work. We explain ways t