Researchers from ETH Zurich have uncovered significant security vulnerabilities in a number of broadly used end-to-end encrypted (E2EE) cloud storage providers.
The cryptographic flaws might permit attackers to bypass encryption, compromise file confidentiality, tamper with information, and even inject unauthorised recordsdata into customers’ storage.
The research analysed 5 E2EE cloud storage suppliers—Sync, pCloud, Seafile, Icedrive, and Tresorit—which collectively serve an estimated 22 million customers worldwide. Every of the providers guarantees strong encryption to safeguard recordsdata from unauthorised entry, even by the service supplier.
Nevertheless, researchers Jonas Hofmann and Kien Tuong Truong found that 4 of the 5 have extreme flaws which may weaken protections. Offered on the ACM Convention on Laptop and Communications Safety (CCS), their findings spotlight potential gaps within the E2EE safety guarantees made by suppliers.
Tresorit stands out however isn’t flawless
Of the providers examined, Tresorit demonstrated the fewest vulnerabilities, with solely minor dangers of metadata tampering and non-authentic keys throughout file sharing. Though much less extreme, these points might nonetheless pose dangers in sure eventualities. In distinction, the opposite 4 providers exhibited extra substantial safety gaps, rising the possibilities of information publicity or tampering.
Key vulnerabilities and sensible threats to E2EE
To guage the energy of E2EE safety, researchers examined ten completely different assault eventualities, assuming the attacker had already gained management over a cloud server with permissions to learn, modify, or inject information. Although this stage of entry is unlikely, the research contends that E2EE needs to be efficient even beneath such situations. Some notable vulnerabilities are:
- Unauthenticated Key Materials: Each Sync and pCloud had been discovered to have unauthenticated encryption keys, permitting attackers to insert their very own keys, decrypt recordsdata, and entry delicate information.
- Public key substitution: Sync and Tresorit had been susceptible to unauthorised key alternative throughout file sharing, permitting attackers to intercept or change recordsdata.
- Protocol downgrade assault: The protocols utilized by Seafile allowed for a downgrade to weaker encryption requirements, making it extra susceptible to brute-force assaults.
Different dangers had been recognized in Icedrive and Seafile, which used unauthenticated encryption modes, permitting attackers to switch and corrupt file contents. Moreover, vulnerabilities within the “chunking” course of throughout a number of providers might compromise file integrity by permitting attackers to reorder, take away, or alter file items.
Supplier gives responses and subsequent steps
In April 2024, the researchers shared their findings with Sync, pCloud, Seafile, and Icedrive, adopted by Tresorit in September. Responses different, with Sync and pCloud but to reply, Seafile making ready to patch the protocol downgrade subject, and Icedrive declining to deal with the issues. Tresorit acknowledged receipt however declined to talk extra.
In line with a current BleepingComputer report, Sync indicated that they’re “fast-tracking fixes” and have already resolved a few of the documented information leak points with file-sharing hyperlinks.
ETH Zurich researchers consider these safety flaws are widespread throughout many E2EE cloud storage platforms, underscoring the necessity for additional investigation and a standardised protocol to make sure safe encryption within the trade.
(Picture by Roman)
See additionally: Why firms proceed to wrestle with cloud visibility – and code vulnerabilities
Need to study extra about cybersecurity and the cloud from trade leaders? Try Cyber Security & Cloud Expo going down in Amsterdam, California, and London. Discover different upcoming enterprise expertise occasions and webinars powered by TechForge here.
/cdn.vox-cdn.com/uploads/chorus_asset/file/25783291/Solo_AirGo_Vision_grey.jpg "Solos challenges Meta’s Ray-Bans with 9 ChatGPT good glasses")