Doubt cast on the security of Kim Dotcom's Mega service
- 22 January, 2013 03:44
Kim Dotcom's bold new venture, the file-storage and sharing service Mega, is drawing criticism as security researchers analyze how the site protects users' data. In short, they advise: don't trust it.
Dotcom threw a large launch party for Mega on Sunday at his mansion outside of Auckland. The service is the successor to Megaupload, the file-sharing site that Dotcom and his colleagues were indicted for in the U.S. in January 2012 on copyright infringement charges.
The flamboyant Dotcom is assuring Mega's users that the site's encryption will protect their privacy and data, but the implementation of that encryption scheme is fundamentally flawed, observers allege.
The problem is that SSL has long been recognized as a weak point on the web. In 2009, security researcher Moxie Marlinspike created a tool called SSLstrip, which allows an attacker to intercept and stop an SSL connection. The attacker can then spy on whatever data the user sends to the fake website.
Since Mega fundamentally relies on SSL, "there is really no reason to be doing client-side encryption," Marlinspike said in an interview Monday. "These kind of schemes are vulnerable to all of the problems with SSL."
Mathias Ortmann, Mega's CTO, said in an interview Monday that there are a variety of web-based attacks that Mega would be vulnerable to just like any other site that relies on SSL for security, such as for online banking. Those scenarios are outlined on Mega's site, he said.
"If they had bothered to read that they would have seen that we basically state exactly what they are accusing us of as possible attack vectors plus some others they are not accusing us of," said Ortmann. "All of these SSL-related attacks do no apply specifically to us. They apply to companies with equally high security requirements or even higher requirements."
SSL is underpinned by encrypted security certificates that are issued by authorized companies and organizations. But the issuing system has long been criticized since scammers have been able to obtain valid certificates for websites they don't own.
Ortmann acknowledged that someone could try to trick a certificate authority into issuing a real SSL certificate for mega.co.nz, which would allow the attacker to create a fake Mega website that appears to have proper credentials.
In a nod to the intense dislike of Kim Dotcom's Mega enterprise, Ortmann said, "I'm actually expecting some government to have a mega.co.nz shadow certificate issued at some point and used in an attack." But Mega will periodically scan for unauthorized SSL certificates, he said.
"Every time you open the website, the encryption code is sent from scratch," Kobeissi said "So if one day I decide I want to disable all encryption for you, I can just serve your username different code that doesn't encrypt anything and instead steals your encryption keys."
Marlinspike said a safer way would be for Mega to use a signed browser extension to encrypt the data, which would prevent tampering by an attacker. Alternatively, an installed software client would accomplish the same end, he said, without exposing a user to the insecurities of SSL.
Marlinspike said he thinks Mega users fundamentally don't care that much about security since they're just interested in file sharing. Since Mega will just see encrypted data on their servers, the setup appears to absolve the site's founders from the copyright infringement issues of Megaupload.
"All that matters is the operators of Mega can claim they don't have the technical ability to inspect the contents on the server for copyright infringement," Marlinspike said.
Like any new online service, Mega's code is already being prodded. On Sunday, it was revealed the site had a cross-site scripting flaw, which in some cases can allow an attacker to steal a user's cookies, which would allow at least a temporary takeover of a victim's account. It was quickly fixed.
"XSS issue was resolved within the hour," wrote Bram van der Kolk, Mega's chief programmer, on Twitter on Sunday. "Very valid point, embarrassing bug."
He said Mega will post more details later today on the website addressing the points raised by its critics in regards to security.
Send news tips and comments to email@example.com. Follow me on Twitter: @jeremy_kirk
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Integration with Financial Cloud Services
- Managing Web Security in an Increasingly Challenging Threat Landscape
- Delta Takes Off with HP Quality Software
- Tech Exchange Presentation: Modern Approaches to the Backup and Recovery of Virtual Machines
- Building Maturity and Experience in Successful Virtualisation Strategies
CIOs say cost, complexity impede true mobile gains in enterprise
The enlightened CIO’s guide to running projects
The enlightened CIO’s guide to running projects
Why IT projects really fail
Queensland government to provide 200 services online by 2015
Top 10 tips for Migration
As users bring multiple devices to the workplace, IT departments need to have a single view of all their mobile devices. Find out how to build a secure and reliable management platform for next generation mobile computing across multiple platforms. Click for more!
Why Deliver Customer Service in the Cloud?
In a volatile and hyper-competitive market, delivering exceptional multichannel customer service consistently is essential. But delivering world-class service on tight budgets and to even tighter deadlines is a tough challenge for even the largest organisations. In this whitepaper, we look at how successful organisations choose to deliver customer service in the cloud.
Best Practice in BYOD
The key trend affecting enterprise mobility today can be summarized in four letters: BYOD – Bring Your Own Device. As the number of end-users bringing devices into your organization grows, so does the need for an effective Enterprise Mobility Management (EMM) solution. Learn how to manage devices across multiple platforms all from a single, centralised and unified management console. Download for more!