Code Vulnerabilities Put Proton Mails at Risk
Code Vulnerabilities Put Proton Mails at Risk
The Sonar Research team discovered critical code vulnerabilities in Proton Mail, Skiff and Tutanota. This post covers the technical details of the XSS vulnerability in Proton Mail.
Key Information
-
In June 2022, the Sonar Research team discovered critical code vulnerabilities in multiple encrypted email solutions, including Proton Mail, Skiff, and Tutanota.
-
These privacy-oriented webmail services provide end-to-end encryption, making communications safe in transit and at rest. Our findings affect their web clients, where the messages are decrypted, mobile clients were not affected.
-
The vulnerabilities would have allowed attackers to steal emails and impersonate victims if they interacted with malicious messages. Nearly 70 million users were at risk on Proton Mail alone.
-
The issue has been fixed and there are no signs of in-the-wild exploitation.
You're viewing a single thread.
Discovered, reported and fixed shortly after. The headline is catchy but the article is more about the process of how it all went down last year.
Also found this noteworthy:
"We would like to thank the Proton Mail team for their fast and professional handling of our report. They also awarded us with a $750 USD bug bounty, which we happily donated to charity."
Now this, this is how you know a company really cares about it's users. Sure $750 probably isn't going to affect their bottom line much but still, it's $750 just handed to some people for securing their customers.
Well said. Not to mention the article title calls out Proton but it's basically all the noteworthy e2ee email products. Very click baity