Several top E2EE cloud storage providers have serious security flaws
A compromised server could be abused, researchers say
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Somecloud storageproviders offering end-to-end encryption (E2EE) are largely operating a broken ecosystem which could, in very realistic theory, allow threat actors to tamper with the files in a way that should not be possible, experts have claimed.
In an in-depth analysis, recently published on the brokencloudstorage.info website, cybersecurity researchers Jonas Hofmann and Kien Tuong Truong from ETF Zurich noted if a threat actor compromises a company server, they can “inject files, tamper with file data, and even gain direct access to plaintext."
During their research, the two experts analyzed five major providers in the field - Sync, pCloud, Icedrive, Seafile, and Tresorit, concluding, “many of our attacks affect multiple providers in the same way, revealing common failure patterns in independent cryptographic designs."
Nation-state targets
On Sync and pCloud, a compromised server could be abused to break the confidentiality of uploaded files, inject files, and tamper with their content, while for Seafile such a server could be used to speed-up brute-force attacks, inject files, and tamper with the content.
For Icedrive, hackers could use a compromised server to break the integrity of uploaded files, inject files, and tamper with their content, while for Tresorid, a broken server could be used to present non-authentic keys, when sharing files. Crooks would also be able to tamper with some metadata in the storage.
The researchers stress that this doesn’t mean that the service providers are malicious, but that these flaws make them a major target for threat actors. More importantly - nation-state threat actors. They also added that compromising a server belonging to an E2EE cloud storage provider isn’t as far-fetched as it may seem at first.
In fact, they argue it’s the “most realistic” adversary model for E2EE cloud storage.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The majority of the service providers mentioned in the report - Sync, Seafile, and Tresorit, were said to have acknowledged the report. Icedrive is yet to address the issue, while there are no reports for pCloud just yet.
ViaThe Hacker News
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
Quordle today – hints and answers for Saturday, November 9 (game #1020)
