[Bimi] Re: Verified Mark Certificates with SVGs not compliant with the Tiny PS profile

["Brotman, Alex" <[e-mail]>]

Hanno,

There had been a ticket open with Adobe to properly support PS, though, that doesn't seem likely at the moment.  However, recently, they did deploy an update [1] as of 28.5 (released in April) to Illustrator to no longer include those x/y attributes (when using SVG Tiny) that had been causing problems.  I realize that any SVGs would need to be re-generated to remove those x/y attributes.  It should be noted that those x/y attributes would cause the documents to also fail validation for SVG Tiny.

All that being said, I'd be interested to take a peek at a few, if you're willing to share the domains.  Feel free to send them privately if you prefer.


1: https://illustrator.uservoice.com/forums/601447-illustrator-desktop-bugs/suggestions/41177212-svg-tiny-1-2-x-y-attributes-in-svg-element

-- 
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast
 

> -----Original Message-----
> From: Hanno Böck <[e-mail]>
> Sent: Sunday, May 26, 2024 5:28 AM
> To: [e-mail]
> Subject: [Bimi] Verified Mark Certificates with SVGs not compliant with the Tiny
> PS profile
> 
> Hi,
> 
> I discovered that SVG logos embedded in many Verified Mark Certificates were
> not compliant with the VMC Requirements.
> 
> A security feature of BIMI and VMCs is that the SVG logos should be validated
> with the SVG Tiny PS (Portable/Secure) [1] profile, a subset of SVG provided as a
> Relax NG schema. This seems like a reasonable idea, as SVG images come with a
> range of possible security risks (XML security risks, XSS).
> 
> However, it does not appear that this is taken very seriously within the BIMI
> ecosystem. I discovered over 200 VMCs, issued over a time span of more than
> four years, with logos not compliant with the SVG Tiny PS profile. Furthermore, it
> does not appear that the largest e-mail provider implementing BIMI - Gmail -
> validates SVG images according to the specification.
> 
> Between 2019 and today, Entrust has issued 223 certificates with non-compliant
> SVGs, more than half of them not yet expired. Digicert has issued two certificates
> with non-compliant SVGs and two more with an invalid data url.
> 
> These non-compliant SVGs were likely mistakes and not part of an attack. There
> are recommendations by BIMIGroup and Gmail to manually edit SVG files created
> by Adobe Illustrator to comply with this profile. Unsurprisingly, this is not very
> reliable.
> 
> You can find a quick and dirty script to validate SVGs in VMCs here [3]. You can
> also find a full list of affected certificates via their crt.sh IDs there in the
> subdirectory testdata.
> 
> I reported the issue to Entrust's problem-reporting mail addresses on 2024-05-17.
> I received an irritating autoreply indicating that this mail address was only meant
> for existing Entrust customers. ("We are unable to associate your email address
> with an active account or order number and are unable to determine your
> support contract.") However, Entrust later confirmed that this is their correct
> problem reporting address, and the issue was addressed.
> 
> I had "accidentally" not reported all unexpired certs with invalid SVGs that I had
> found and added a few certs with valid SVG files. (I may have done that to test
> whether Entrust would notice it.)
> 
> To their credit, Entrust did not revoke the certificates with valid SVGs and they
> revoked all the certificates with invalid SVGs, including those I had not reported.
> Entrust revoked all affected certificates as of 2024-05-23. This is slightly longer
> than the 5 days that the VMC requirements demand[2].
> 
> The affected Digicert certificates were all expired. Therefore, I have not reported
> them.
> 
> I also noticed that certificates with those not validating SVGs would still be
> displayed within Gmail. I reported this to Gmail, but they appear to have decided
> that it is not an issue deserving their attention. ("We've decided that the issue you
> reported is not severe enough for us to track it as a security bug.")
> 
> I was surprised by this reaction. I would expect security-conscious implementors
> of BIMI to validate SVGs against the security profile.
> While I assume Gmail has additional security measures like sandboxing their SVG
> renderer, there is an important indirect effect that such a validation would have:
> it is very likely that this issue would have been detected much sooner if the invalid
> logos had not been displayed in Gmail.
> 
> Ultimately, the most noteworthy part of this issue is that it stayed undetected for
> so long. Over a timeframe of more than four years, Entrust has issued over 200
> certificates with SVG files not validating against the security profile. Entrust did
> not notice it, and neither did anyone else. It does not appear anyone is
> monitoring the VMC/BIMI ecosystem for compliance with the specs and security
> requirements.
> 
> 
> [1] https://urldefense.com/v3/__https://bimigroup.org/resources/SVG_PS-
> latest.rnc.txt__;!!CQl3mcHX2A!GpM0XUO_Vl07CUJ7oWbLZFHVe1STYYR5SJ1H2G
> tsXIgbJvzy-ZiTutuGb9aMsJaJDZA9MvDhh9h2IBSP12X34fM$
> [2]
> https://urldefense.com/v3/__https://bimigroup.org/resources/VMC_Requiremen
> ts_latest.pdf__;!!CQl3mcHX2A!GpM0XUO_Vl07CUJ7oWbLZFHVe1STYYR5SJ1H2G
> tsXIgbJvzy-ZiTutuGb9aMsJaJDZA9MvDhh9h2IBSPKtbwqxk$
> [3]
> https://urldefense.com/v3/__https://github.com/hannob/vmcval__;!!CQl3mcHX
> 2A!GpM0XUO_Vl07CUJ7oWbLZFHVe1STYYR5SJ1H2GtsXIgbJvzy-
> ZiTutuGb9aMsJaJDZA9MvDhh9h2IBSP6vcW0xw$
> 
> --
> Hanno Böck - Independent security researcher
> https://urldefense.com/v3/__https://itsec.hboeck.de/__;!!CQl3mcHX2A!GpM0X
> UO_Vl07CUJ7oWbLZFHVe1STYYR5SJ1H2GtsXIgbJvzy-
> ZiTutuGb9aMsJaJDZA9MvDhh9h2IBSPj5luxag$
> 
> --
> bimi mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]