Wikileaks Glimpse pt 2.

Sigh, for someone that has served their country, you sure do like to keep your head in the sand.


http://blog.erratasec.com/2016/10/yes-we-can-validate-wikileaks-emails.html#.WBuhmH-7qHt

 

These guys don't make mistakes eh?

 

Readers can conduct the DKIM tests themselves. For example, the commercial email program Thunderbird allows a “DKIM” add-on, which automatically checks the key in each message against the shared encryption system.

edit:

and here are some independent people testing them



Some of the messages failed some DKIM tests but passed also passed other other DKIM tests. Security experts blame the few failures on the process by which Wikileaks’s source may have copied and disseminated the emails. But they warn if a message is validated by even one test, then that message is valid and unchanged.

“There are lots of reasons” why a valid message released via Wikileaks might fail a few DKIM tests, said Graham. For example, the Wikileaks process may drop digits from buried code in the message, he said.

“DKIM is super finicky. If someone at wikileaks accidentally hit tab, or spacebar or whatever and then saved it, that’s enough for DKIM to fail,” said another person checking the emails.

This post on /r/wikileaks brings up that a number of recently released e-mails failed DKIM verification.

I can confirm that the e-mails in this post did fail DKIM verification. (And I thank the user for taking the time to check them and bring it to our attention!) However, there are a number of explanations for this.


This e-mail (25226) is one of the ones that fails DKIM verification.


Fortunately, this e-mail (600) is later in the same e-mail chain. That means everything in e-mail 25226 is included in e-mail 600.

E-mail 600 passes DKIM verification. Therefore, everything in 25226 has been verified by 600.

 

no...I have seen govt corruption first hand and already explained this.....I'm reading your posts and contest your unbridled trust in the WikiLeaks info....that's a choice I make from my experience dealing with classified material during wartime....you don't need to understand why I'm pessimistic about internet leaks or whether or not computer experts can fuck with the info.....I say, more than likely they can. You don't.......so I respect your opinion, but disagree with it....

 

Trump probably doesnt use email. If he does its probably all caps convos with stewie rah rah.

 

Just please read up on the way that these things can be verified, by anyone.


You can't just delete words and shit and then post these things as real. It doesn't work that way.

 

That the emails that he sent are real. Exactly what River was suggesting they are not.

 

I know there's corruption in govt.......my question is why does it surprise anyone? Emails, I don't trust to be set in stone....at the bottom of your last post it says....I trust Mozilla....which is a choice...now I don't know much about computer programming or codes granted....but I know a little about classified material and corruption ....to think there's nobody who can alter info because it's been checked....well we used to say that under Nixon too. Don't worry...we've already checked it and now it's ash

 

to our knowledge....that's where the can of worms usually cracks open...you trust it doesn't work that way if you choose to believe the results. I don't.

 

I didn't say they weren't real.....I was saying they could have been altered...so my doubt is whether you are getting untainted results.

 

No it doesn't surprise me. What does surprise me is the depth and absolutely scale at which this is occurring within the Clinton Foundation and her network. I expect her and her husband to be in jail soon.

 

LOL , go read this:

http://blog.erratasec.com/2016/10/yes-we-can-validate-wikileaks-emails.html#.WBulBn-7qHu

 

From the security blog, when someone said the same thing:

"Actually, DKIM does a one way hash of the entire contents, so any changes in the content would cause a invalid test.So, regardless of your political beliefs, this would not work. DKIM signs the email by encrypting the one way hash of the content. So this is wrong."

 

Weaknesses in the WikiLeaks system....of course, this is just Wikipedia info
Weaknesses[edit]
The RFC itself identifies a number of potential attack vectors.[29]

DKIM signatures do not encompass the message envelope, which holds the return-path and message recipients. Since DKIM does not attempt to protect against mis-addressing, this does not affect its utility. A concern for any cryptographic solution would be message replay abuse, which bypasses techniques that currently limit the level of abuse from larger domains [clarification needed]. Replay can be inferred by using per-message public keys, tracking the DNS queries for those keys and filtering out the high number of queries due to e-mail being sent to large mailing lists or malicious queries by bad actors. For a comparison of different methods also addressing this problem see e-mail authentication.

Arbitrary forwarding[edit]
As mentioned above, authentication is not the same as abuse prevention. An evil email user of a reputable domain can compose a bad message and have it DKIM-signed and sent from that domain to any mailbox from where they can retrieve it as a file, so as to obtain a signed copy of the message. Use of the l tag in signatures makes doctoring such messages even easier. The signed copy can then be forwarded to a million recipients, for example through a botnet, without control. The email provider who signed the message can block the offending user, but cannot stop the diffusion of already-signed messages. The validity of signatures in such messages can be limited by always including an expiration time tag in signatures, or by revoking a public key periodically or upon a notification of an incident. Effectiveness of the scenario can hardly be limited by filtering outgoing mail, as that implies the ability to detect if a message might potentially be useful to spammers.[30]

Content modification[edit]
DKIM currently features two canonicalization algorithms, simple and relaxed, neither of which is MIME-aware.[31] Mail servers can legitimately convert to a different character set, and often document this with X-MIME-Autoconverted header fields. In addition, servers in certain circumstances have to rewrite the MIME structure, thereby altering the preamble, the epilogue, and entity boundaries, any of which breaks DKIM signatures. Only plain text messages written in us-ascii, provided that MIME header fields are not signed,[32] enjoy the robustness that end-to-end integrity requires.

The OpenDKIM Project organized a data collection involving 21 mail servers and millions of messages. 92.3% of observed signatures were successfully verified, a success rate that drops slightly (90.5%) when only mailing list traffic is considered.[33]

Annotations by mailing lists[edit]
The problems might be exacerbated when filtering or relaying software makes changes to a message. Without specific precaution implemented by the sender, the footer addition operated by most mailing lists and many central antivirus solutions will break the DKIM signature. A possible mitigation is to sign only designated number of bytes of the message body. It is indicated by l tag in DKIM-Signature header. Anything added beyond the specified length of the message body is not taken into account while calculating DKIM signature. This won't work for MIME messages.[34]

Another workaround is to whitelist known forwarders, e.g. by SPF. For yet another workaround, it was proposed that forwarders verify the signature, modify the email, and then re-sign the message with a Sender: header.[35] However, it should be noted that this solution has its risk with forwarded 3rd party signed messages received at SMTP receivers supporting the RFC 5617 ADSP protocol. Thus, in practice, the receiving server still has to whitelist known message streams.

Short key vulnerability[edit]
In October 2012, Wired reported that mathematician Zach Harris detected and demonstrated an email source spoofing vulnerability with short DKIM keys for the google.com corporate domain, as well as several other high-profile domains. He stated that authentication with 384-bit keys can be factored in as little as 24 hours "on my laptop," and 512-bit keys, in about 72 hours with cloud computing resources. Harris found that many organizations sign email with such short keys; he factored them all and notified the organizations of the vulnerability. He states that 768-bit keys could be factored with access to very large amounts of computing power, so he suggests that DKIM signing should use key lengths greater than 1,024. Wired stated that Harris reported, and Google confirmed, that they began using new longer keys soon after his disclosure. According to RFC 6376 the receiving party must be able to validate signatures with keys ranging from 512 bits to 2048 bits, thus usage of keys shorter than 512 bits might be incompatible and shall be avoided. The RFC 6376 also states that signers must use keys of at least 1024 bits for long-lived keys, though long-livingness is not specified there.[36]

 

River the DKIM keys on the Clinton email server were 1024 bit.

Not sure what you're trying to show here.
Mis-addressing is not in question.
Content modification would break DKIM signatures, they are not broken.

Also, this isnt a wikileaks system, this is in majority if not all mail servers.

 

I'm not defending Hillary by a long shot but I looked up DKIM to see what they said and apparently....it has flaws....apparently email formats can also be changed but in this cyber world...my logic says there are humans who can alter things so they are not quite as trustworthy as they've appeared to be....WikiLeaks I learned is also a system with connections to several major web browsers...yahoo, etc...now call me naïve but I'd think there's probably a code to break their system without detection. I'm sure the vast majority of content they display is legit.....I'm also sure that they probably veil some things to make them look transparent. I don't want the internet governing my country or influencing our elections....the sad thing is that candidates can run for office without these things disqualifying them to start with. We need to raise the bar for anyone who runs for president obviously. Trump's past is about as sleazy as you could get.