Venafi predicts €10,000 Mega bounty will be paid out
Encryption firm calls out Kim Dotcom’s approach to security as “bizarre".
Enterprise security firm Venafi claims Kim Dotcom's offer of 10,000 for the first person to crack his new Mega file storage site will be collected.
The challenge was announced through the site's blog in response to criticism over its security procedures, including the fact there is no end-to-end encryption.
In its response to the challenge, Venafi added its own criticism, stating that - as the encryption keys are stored along with the users' files on the system - user data was more vulnerable.
Calum MacLeod, EMEA director at Venafi, said: "This bizarre and, quite frankly, less secure approach to encryption seems to be in place solely to protect Mr Dotcom from prosecution, on the basis that he and his staff cannot have any knowledge of the data that is being stored on their cloud computing servers.
"While this is perhaps understandable given the fact that [he] was arrested in New Zealand 12 months ago in connection with copyright infringement surrounding his original MegaUpload file storage and sharing service, the lack of security surrounding the encryption keys leaves the system vulnerable."
Mega's password system also came in for criticism from MacLeod, as users have the double burden of supporting account authentication without disclosing that password to Mega's servers as well as outer level data encryption.
This approach, he claims, is a weak security system because obtaining the master key is based on a simple token system that can be replayed, rather than the more usual secure challenge/response technology seen on commercial services.
"This weakness could be exploited through the use of a timing vulnerability when the server compares the user's hash data, allowing a hacker to progressively learn how to access the system using multiple attempts," he said.
"We fully expect this methodology to be exploited by would-be crackers wanting to collect the 10,000 bounty," MacLeod concluded.
The case for a marketing content hub
Transform your digital marketing to deliver customer expectationsDownload now
Fast, flexible and compliant e-signatures for global businesses
Be at the forefront of digital transformation with electronic signaturesDownload now
Why CEOS should care about the move to SAP S/4HANA
And how they can accelerate business valueDownload now
IT faces new security challenges in the wake of COVID-19
Beat the crisis by learning how to secure your networkDownload now