One of the most popular cloud storage in the world (opens in new tab) service providers carried several serious vulnerabilities that allowed threat actors to read even (opens in new tab) files, researchers found.
A team at ETH Zurich discovered five vulnerabilities in the Mega platform that revolve around stealing and decrypting an RSA key (a private key based on the RSA algorithm).
The team discovered the flaws in late March of this year and reported it to the company. Soon, Mega released patches and mitigations for some of the flaws, while for others, the patches are still a work in progress. The patches do not affect the user experience and do not require users to re-encrypt their stored data, it was said. They also don’t need to change any passwords or create new keys.
Ideal for dissatisfied employees
While patches aren’t available for every flaw that’s certainly bad news, the good news is that Mega has yet to see anyone exploit them in the wild. There is no concrete timeline as to when the remaining patches will be released.
In a video explanation of the flaw, the researchers said that the attack is based on prime factor guessing by comparison and that the attacker would need at least 512 login attempts to breach an endpoint. (opens in new tab). Furthermore, they would also need to have access to Mega’s servers, which means that for outside threats – vulnerabilities aren’t exactly viable.
For insiders or disgruntled employees, however, it’s an entirely different story.
“Seeing how seemingly innocuous cryptographic design shortcuts taken nearly a decade ago backfire under scrutiny by three of the brightest minds in the industry is both frightening and intellectually fascinating,” Mega said in a statement.
“The very high limit of exploitability, despite the wide range of cryptographic flaws identified, provides a certain sense of relief.”
A detailed failure analysis and MEGA countermeasures can be found at this link (opens in new tab).
Through: BleepingComputer (opens in new tab)
