Cybersecurity researchers have discovered severe cryptographic issues in various end-to-end encrypted (E2EE) cloud storage platforms that could be exploited to leak sensitive data.
“The vulnerabilities range in severity: in many cases a malicious server can inject files, tamper with file data, and even gain direct access to plaintext,” ETH Zurich researchers Jonas Hofmann and Kien Tuong Truong said. “Remarkably, many of our attacks affect multiple providers in the same way, revealing common failure patterns in independent cryptographic designs.”
The identified weaknesses are the result of an analysis of five major providers such as Sync, pCloud, Icedrive, Seafile, and Tresorit. The devised attack techniques hinge on a malicious server that’s under an adversary’s control, which could then be used to target the service providers’ users.
A brief description of the flaws uncovered in the cloud storage systems is as follows –
- Sync, in which a malicious server could be used to break the confidentiality of uploaded files, as well as injecting files and tampering with their content
- pCloud, in which a malicious server could be used to break the confidentiality of uploaded files, as well as injecting files and tampering with their content
- Seafile, in which a malicious server could be used to speed-up brute-forcing of user passwords, as well as injecting files and tampering with their content
- Icedrive, in which a malicious server could be used to break the integrity of uploaded files, as well as injecting files and tampering with their content
- Tresorit, in which a malicious server could be used to present non-authentic keys when sharing files and to tamper with some metadata in the storage
These attacks fall into one of the 10 broad classes that violate confidentiality, target file data and metadata, and allow for injection of arbitrary files –
- Lack of authentication of user key material (Sync and pCloud)
- Use of unauthenticated public keys (Sync and Tresorit)
- Encryption protocol downgrade (Seafile),
- Link-sharing pitfalls (Sync)
- Use of unauthenticated encryption modes such as CBC (Icedrive and Seafile)
- Unauthenticated chunking of files (Seafile and pCloud)
- Tampering with file names and location (Sync, pCloud, Seafile, and Icedrive)
- Tampering with file metadata (impacts all five providers)
- Injection of folders into a user’s storage by combining the metadata-editing attack and exploiting a quirk in the sharing mechanism (Sync)
- Injection of rogue files into a user’s storage (pCloud)
“Not all of our attacks are sophisticated in nature, which means that they are within reach of attackers who are not necessarily skilled in cryptography. Indeed, our attacks are highly practical and can be carried out without significant resources,” the researchers said in an accompanying paper.
“Additionally, while some of these attacks are not novel from a cryptographic perspective, they emphasize that E2EE cloud storage as deployed in practice fails at a trivial level and often does not require more profound cryptanalysis to break.”
While Icedrive has opted not to address the identified issues following responsible disclosure in late April 2024, Sync, Seafile, and Tresorit have acknowledged the report. The Hacker News has reached out to each of them for further comment, and we will update the story if we hear back.
The findings come a little over six months after a group of academics from King’s College London and ETH Zurich detailed three distinct attacks against Nextcloud’s E2EE feature that could be abused to break confidentiality and integrity guarantees.
“The vulnerabilities make it trivial for a malicious Nextcloud server to access and manipulate users’ data,” the researchers said at the time, highlighting the need to treat all server actions and server-generated inputs as adversarial to address the problems.
Back in June 2022, ETH Zurich researchers also demonstrated a number of critical security issues in the MEGA cloud storage service that could be leveraged to break the confidentiality and integrity of user data.
Responses from the companies
Icedrive – We are aware of this research paper. The paper describes possible attacks within the “compromised server” threat model, where an adversary gains full control over a file server and can modify or delete files. The paper also mentions the use of a MITM server which must be able to decrypt HTTPS/SSL traffic.
We want to reassure our users that there is no real danger to the zero-knowledge encrypted data stored on our servers – it cannot be decrypted without knowing the passphrase. If someone gains full control over a file server (which in itself is not an easy task) and tampers with a user’s files, our apps will detect this using the file integrity checks we have and will not decrypt the files, issuing an error warning.
We are constantly improving our apps and services, fixing issues and adding new features. We will carefully review our encryption methods and update them to comply with current industry standards.
Sync – Our security team became aware of these issues on October 11, and we’ve since taken swift action to address them. We’ve also reached out to the research team to share findings and collaborate on next steps.
The potential data leak issue on links (as reported) has already been fixed, and we are fast-tracking fixes for the remaining potential issues right now. As the research paper outlines, these vulnerabilities exist under the pretext of a compromised server. There is no evidence that these vulnerabilities have been exploited or that file data has been accessed.
We understand that by using Sync, trust is placed in us. But the promise of end-to-end encryption is that you don’t need to trust anyone, not even us. This concept is at the core of our encryption model and central to what we do.
We’re committed to getting these issues resolved.