Several top E2EE cloud storage providers have serious security flaws

Date:
Mon, 21 Oct 2024 19:22:00 +0000

Description:
Some providers acknowledged the findings.

FULL STORY ======================================================================

Some cloud storage providers offering end-to-end encryption (E2EE) are
largely operating a broken ecosystem which could, in very realistic theory, allow threat actors to tamper with the files in a way that should not be possible, experts have claimed.

In an in-depth analysis, recently published on the brokencloudstorage.info website, cybersecurity researchers Jonas Hofmann and Kien Tuong Truong from ETF Zurich noted if a threat actor compromises a company server, they can inject files, tamper with file data, and even gain direct access to plaintext."

During their research, the two experts analyzed five major providers in the field - Sync, pCloud, Icedrive, Seafile, and Tresorit, concluding, many of
our attacks affect multiple providers in the same way, revealing common failure patterns in independent cryptographic designs." Nation-state targets

On Sync and pCloud, a compromised server could be abused to break the confidentiality of uploaded files, inject files, and tamper with their content, while for Seafile such a server could be used to speed-up
brute-force attacks, inject files, and tamper with the content.

For Icedrive, hackers could use a compromised server to break the integrity
of uploaded files, inject files, and tamper with their content, while for Tresorid, a broken server could be used to present non-authentic keys, when sharing files. Crooks would also be able to tamper with some metadata in the storage.

The researchers stress that this doesnt mean that the service providers are malicious, but that these flaws make them a major target for threat actors. More importantly - nation-state threat actors. They also added that compromising a server belonging to an E2EE cloud storage provider isnt as far-fetched as it may seem at first.

In fact, they argue its the most realistic adversary model for E2EE cloud storage.

The majority of the service providers mentioned in the report - Sync,
Seafile, and Tresorit, were said to have acknowledged the report. Icedrive is yet to address the issue, while there are no reports for pCloud just yet.

Via The Hacker News More from TechRadar Pro Proton's encrypted cloud storage is going mobile Here's a list of the best firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/several-top-e2ee-cloud-storage-provider s-have-serious-security-flaws


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)