Slashdot Mirror
File-hosting Sites Not a Safe Haven For Private Data
An anonymous reader tips a story at the Register, according to which "Academic researchers say they've uncovered weaknesses in dozens of the most popular file hosting sites that allow people to gain unauthorized access to data that's supposed to be available only to those selected by the user."
Just another reason why you should be using file encryption such as Truecrypt to encrypt everything personal.
Even if it's on your own hard drive. You're only one rootkit away from giving it away to the world.
In Soviet Russia, Trojan exploits YOU!
Why would you upload private data to some file hosting site? These (e.g. RapidShare) aren't the kind of services where you can modify files after uploading (such as Dropbox), so encryption is not much of a hassle. You have no reason not to encrypt the files before uploading them.
I dream of a nation where a man is not judged by his skin color but by an number assigned by a credit rating agency.
At a guess, an embedded URL that's loaded automatically when someone opens the document, for example an IMG tag.
This is the kick-off to Slashdot's "No Shit Week"
How about Mediafire? All those other sites seem like general file hosting sites, media fire always seemed to me to lean itself towards personal storage, and private if you choose not to share it. If I recall you have to choose to share each folder/item instead of it being shared automatically. They looked at the most popular sites but what makes those sites more popular is the public sharing aspect.
The services, which include sites such RapidShare, FileFactory, and Easyshare, allow users to upload large files and make them available to anyone who knows the unique URI (or Uniform Resource Identifier) that's bound to each one. Users may post the link on websites or forums available to the public or share it in a single email to prevent all but the recipient from downloading it. RapidShare, for instance, says it can be used to “share your data with your friends, colleagues or family.”
But according to academics in Belgium and France, a “significant percentage” of the 100 FHSs (or file hosting services) they studied made it trivial for outsiders to access the files simply by guessing the URLs that are bound to each uploaded file. What's more, they presented evidence that such attacks, far from being theoretical, are already happening in the wild.
Stopped reading right there. It's not private just because the URL is some randomly generated string. These sites are not designed to securely transfer files to only the recipient so this is not in any way a "weakness".
“These services adopt a security-through-obscurity mechanism where a user can access the uploaded files only by knowing the correct download URIs,” the researchers wrote in a paper presented at the most recent USENIX Workshop on Large-Scale Exploits and Emergent Threats.
Hey, guess how passwords work? They're hard to guess. How do biometrics work? Your fingerprints are hard to replicate. How do keycards work? It's hard to guess whatever code is stored in it. All security ultimately comes down to some token that is "obscure."
All security is through obscurity. If these sites are being accessed when they shouldn't, it means that there's an information leak, that is, the owners think (or claim) that it is far more obscure than it really is.
That link I posted to a rar full of my favorite pr0n pics on /b/ is easy pickings to thousands of other online users? No wai!
I mean, I had no idea most people who used quick upload services like imgur, rapidshare, and mediafire uploaded most of their files with any implied expectancy of privacy. But boy was I wrong!
That was my initial reaction, but on second thought I think it is fairly newsworthy.
The Register's audience is regular users, who do stuff like put sensitive documents on a file sharing site. It's worth a few paragraphs to remind people not to do idiotic things.
It's also worth noting that these sites either a. have index pages turned on and don't know it, which would be so incompetent as to make me wonder how they keep a file server running or b. are allowing these pages to be crawled and telling their users that they aren't, which is unethical as hell and possibly illegal.
I suspect it means a Web bug, aka a Web beacon.
It is safer and better.
In a contest of brute force, SSH keys are exponentially superior to passwords. You're not going to get passwords to have the same resistance. Period.
Not to mention, keyed access removes a great deal of moronic IT bullshit regarding password policies - you know, the policies that lead to weak passwords, lead to users actively subverting those policies ("Fuck this monthly change shit, I'm using p4ssword02. And next month, I'll use p4ssword03.", et cetera.
One of the main problems with keys is that they're much too long for most users to remember, so they almost always end up stored in a file or database of some sort. This act alone reduces the overall security far, far more than the risk of a brute-force attack.
Uh, no it doesn't. You not only have to get into my machine to find the key file, you also have to break the passphrase on that key file.
So at worst it's no less secure than a password, and at best it's far more secure.
Brute-force attacks should never be an issue, regardless of whether passwords or keys are being used. Even shitty authentication systems will lock accounts after a small number of failures, or will at least introduce an exponential delay between subsequent attempts. If you can only perform 20 failed logins per day, if not fewer, for a given account, then it will significantly reduce the potential of a successful brute-force attack.
If that was implemented for SSH on a Internet facing machine, nobody could ever log on, the accounts would be always locked.
And if it's 20 failed logins per IP, then it's useless, since many attackers use botnets.
One of the main problems with keys is that they're much too long for most users to remember, so they almost always end up stored in a file or database of some sort. This act alone reduces the overall security far, far more than the risk of a brute-force attack. Given that they're often stored in common locations, even on different installations of different operating systems, all it takes are slightly incorrect permissions on a user's home directory and their keys are easily accessible. It gets worse if the system or home directory is periodically backed up, with the key being propagated (perhaps unknowingly!) to other media and locations,.
That's why keys have - wait for it - passphrases!
Dilbert RSS feed
The recent complaints about Dropbox and similar file storage sites violating users' privacy in return to lawsuits is because the site is doing the encryption, not the user.
If you want to protect your data, you can never hand the storage site unencrypted data, and this includes handing them encrypted data along with the keys. Ideally, depending on the kind of security you're looking for, you'd like their storage system not to store files in ways that are easily traced back to you (for instance, the file gets stored with a filename that's a random string, and the storage site forgets who it belongs to after storing the file, so that anybody who steals the disk drive only knows that there are files named "bunch of random digits", and has know way to know which ones belong to which users. Anybody who wants to recover the file needs to know the filename (so the service can retrieve it) and the decryption key (which the service doesn't know.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
There are lots of services like Dropbox and Evernote and Pick-your-favorite-Online-Backup-Service that are focused on people storing their own data or on data they're only going to share with a small number of people (e.g. web upload/download instead of FTP, for people behind firewalls or with random DHCP addresses), and many of them give their users the idea that they're getting privacy. It's different from the Youtube-without-censorship file upload site market.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
"He who trusts private data to remote host has head in cloud..."
"The Register's audience is regular users"
El Reg?
Hardly.
Gamers and tech heads, through IT folk, security researchers and software engineers. It's got articles for everyone. It's often more hardcore than slashdot these days, which says more about the decline of slashdot than anything else...
Part of the issue is how these sites market themselves. Many sell themselves as "a fast, easy, secure way to send files to friends and colleagues without being hit by such bothersome things as email size limits or limits on sending executables".
The security they provide varies. Some allow you to password-protect the download (so nobody's getting it without entering the password first). Others don't do this, the security stems from the URL they give you to include in the email being apparently-random and not published anywhere. Security through obscurity, in other words. To you and me, this is a disaster waiting to happen, but these products aren't being used by you and me. They're being used by others in the business who are annoyed that the IT department is blocking them from sending out a particular attachment, and rather than ask the IT department to come up with a solution are instead using such a service. It's actually pretty common for these companies to offer corporate accounts so you can give your users a solution which is branded with your company name and logo and allows you to enforce rules regarding what options users may choose when they come to send a file. But corporate accounts cost money, getting the money means setting up a project and will take a minimum of a couple of months. This file needs to reach the recipient in a couple of hours.
These researchers have demonstrated that not only are the URLs generated not particularly random, they're easy to guess and people are already guessing them left and right.
While you have a point that many security methods such as passwords rely on 'obscurity', one can still make a distinction between methods which rely on poorly measured (and typically low) entropy and methods which rely on well defined entropy. Usually when people talk about the dangers of security through obscurity, they are talking of the former;...
No. Security by obscurity means security achieved by keeping the details of your system secret (architecture, algorithms, etc), so people don't know how to break in. The accepted way to do security, on the other hand, is to build a system that is secure even against adversaries who know everything about your system, lacking only a well defined credential or set of credentials (a password, certificate, fingerprint, etc).
Using "secret" urls to provide access is not security by obscurity if there is enough randomness involved that urls are practically unguessable, though if it does not go over HTTPs it is certainly weak against certain threat models (Man-in-the-middle).