Pretty Good Piggy-backing Parsing vulnerabilities in PGP Desktop

In this paper we demonstrate ‘piggy-back’ attacks on PGP Desktop 10 and its predecessors which can be exploited in targeted cybercrime attacks, i.e. targeting specific influential persons within an organization. We show that an attacker can add PGP messages (e.g. malicious files) into existing PGP messages signed by trusted sources in such a way that PGP Desktop still indicates that the result is signed while the decryption includes the additional messages. This could be exploited by an active attacker adding malicious content (e.g., executables or incriminating content such as pictures) into a PGP message: the result is still indicated authentic by PGP Desktop but the decrypted content will not only contain the legitimate message but also the malicious content.