File-hosting Sites Not a Safe Haven For Private Data

An anonymous reader tips a story at the Register, according to which "Academic researchers say they've uncovered weaknesses in dozens of the most popular file hosting sites that allow people to gain unauthorized access to data that's supposed to be available only to those selected by the user."

Comments

Encrypt Everything Private

[Deathlizard]

Just another reason why you should be using file encryption such as Truecrypt to encrypt everything personal.

Even if it's on your own hard drive. You're only one rootkit away from giving it away to the world.

Re:Encrypt Everything Private

[x*yy*x]

Crypting your data won't save it from rootkit...

Re:Encrypt Everything Private

[TheEyes]

But in order to actually use encrypted data, it has to be decrypted at some point, so the rootkit just needs to wait for you to decrypt it. In the case of say, full disk encryption, this is rather easy.

The idea is that you encrypt the file you send to the filesharing site, that way when the filesharing site is hacked all the attackers get is an encrypted file. In fact this is a "perfect" use for data encryption: the file is never decrypted on the remote machine, only on your local one, so stealing the data off the remote site can never give an attacker access to anything but cyphertext.

Encryption

[igreaterthanu]

Why would you upload private data to some file hosting site? These (e.g. RapidShare) aren't the kind of services where you can modify files after uploading (such as Dropbox), so encryption is not much of a hassle. You have no reason not to encrypt the files before uploading them.

Re:Encryption

[hairyfeet]

Because you get some dumbass that can't be arsed to bring a flash stick to work and/or they aren't allowed to use a flash stick, so they just upload it to Rapidshit? Hell nobody reads anything or actually thinks anymore, even to this day you can look on any P2P site for the formats that taxes and other personal data are kept in (such as QuickBooks files) and literally find thousands upon thousands of morons sharing their entire C: drive because they don't bother to think.

To me that is the sad and/or scary part: Your security is only as strong as the biggest moron in the group and when it comes to computers the level of stupid out there is frankly mind boggling.

Re:Encryption

[currently_awake]

Considering the cost of hard drives there is no good reason to keep anything in the cloud except for stuff you want to share (free hosting file server).

Re:Encryption

[wvmarle]

Many people for some reason think it's safe because the site says they will protect your data.

Well maybe they can protect your data and will do some effort for it, the fact is you're putting your data on someone else's computer. The owner of that system (basically anyone with high enough privileges or physical access to the system) can access your data. They not necessarily will, but they can. And that little factoid is enough to make it insecure.

That such file hosting sites may have additional security holes allowing access to data one shouldn't have access too, is not important any more. When it's out of your controlled environment, the data is out of your control.

The only way to use remote hosting securely is to either own and directly control the remote hosting site by yourself, or to encrypt everything before it leaves your controlled environment, and keep the secret key to yourself. It's as simple as that. I'm wondering why this is even considered news here.

Re:Bogus

[Beryllium Sphere(tm)]

At a guess, an embedded URL that's loaded automatically when someone opens the document, for example an IMG tag.

Like Shark Week?

[The Dawn Of Time]

This is the kick-off to Slashdot's "No Shit Week"

All security is through obscurity

[sco08y]

“These services adopt a security-through-obscurity mechanism where a user can access the uploaded files only by knowing the correct download URIs,” the researchers wrote in a paper presented at the most recent USENIX Workshop on Large-Scale Exploits and Emergent Threats.

Hey, guess how passwords work? They're hard to guess. How do biometrics work? Your fingerprints are hard to replicate. How do keycards work? It's hard to guess whatever code is stored in it. All security ultimately comes down to some token that is "obscure."

All security is through obscurity. If these sites are being accessed when they shouldn't, it means that there's an information leak, that is, the owners think (or claim) that it is far more obscure than it really is.

Re:All security is through obscurity

[DoofusOfDeath]

Hey, guess how passwords work? They're hard to guess.

But when you're using HTTPS, a password is usually passed along a pre-secured channel. Aren't these URI's visible to all routers in between you and the file site, as well as any computer monitoring traffic on your local LAN?

If so, that's somewhat less secure than passwords.

Re:All security is through obscurity

[Anonymous Coward]

They are different and better than passwords, and they are not lengthy passwords that are stored in files. The entire mechanism of authentication using public-key cryptography is different. When you authenticate with a password, you send the password to the server, which compares it against some stored credential. When you authenticate using a key file or certificate, you take some set of values that usually includes something random from the server, generate a signature, and encrypt it using your private key. The server then decrypts it using your public key and makes sure the signature is correct. Your "lengthy password in a file" is never sent to the server, no representation of it is ever stored on the server, and the value you send for authentication cannot be intercepted and reused on the same server or any other.

I doubt there is anyone that thinks certificates or keys are less valuable than passwords if compromised, they just realize they are less likely to be compromised.

Re:So what you're telling me is...

[sco08y]

That link I posted to a rar full of my favorite pr0n pics on /b/ is easy pickings to thousands of other online users? No wai!

I mean, I had no idea most people who used quick upload services like imgur, rapidshare, and mediafire uploaded most of their files with any implied expectancy of privacy. But boy was I wrong!

That was my initial reaction, but on second thought I think it is fairly newsworthy.

The Register's audience is regular users, who do stuff like put sensitive documents on a file sharing site. It's worth a few paragraphs to remind people not to do idiotic things.

It's also worth noting that these sites either a. have index pages turned on and don't know it, which would be so incompetent as to make me wonder how they keep a file server running or b. are allowing these pages to be crawled and telling their users that they aren't, which is unethical as hell and possibly illegal.

Re:Bogus

[Opyros]

I suspect it means a Web bug, aka a Web beacon.

You Have to Encrypt It Yourself

[billstewart]

The recent complaints about Dropbox and similar file storage sites violating users' privacy in return to lawsuits is because the site is doing the encryption, not the user.

• The user uploads unencrypted data to the site across an encrypted SSL tunnel. W00t! We're R333713 S3kr1t Heer!
• The site unpacks the tunnel and stores the data, possibly encrypted using a key they know, or possibly just with passwords to keep unauthorized users out.
• The receiving user gives the site a password, and the site gives the user the again-unencrypted data over another R3333713 S3kr1t encrypted SSL tunnel. ,li>The FBI hands the Storage site a subpoena or warrant or National Security Letter or a note from their mom, and the site hands over the stored data and any keys they have, along with the transaction records from the upload.

If you want to protect your data, you can never hand the storage site unencrypted data, and this includes handing them encrypted data along with the keys. Ideally, depending on the kind of security you're looking for, you'd like their storage system not to store files in ways that are easily traced back to you (for instance, the file gets stored with a filename that's a random string, and the storage site forgets who it belongs to after storing the file, so that anybody who steals the disk drive only knows that there are files named "bunch of random digits", and has know way to know which ones belong to which users. Anybody who wants to recover the file needs to know the filename (so the service can retrieve it) and the decryption key (which the service doesn't know.)

Re:How about

[wvmarle]

It is on a remote site, out of your control, so it's not secure. End of story.

Encrypt before it leaves your system if you want to keep it secure. Or only store data on such sites that you really don't care if it becomes public.

And even if there really are no remote security holes, anyone with admin/root access to the servers can access your data. Without you knowing.

Re:So what you're telling me is...

[billstewart]

There are lots of services like Dropbox and Evernote and Pick-your-favorite-Online-Backup-Service that are focused on people storing their own data or on data they're only going to share with a small number of people (e.g. web upload/download instead of FTP, for people behind firewalls or with random DHCP addresses), and many of them give their users the idea that they're getting privacy. It's different from the Youtube-without-censorship file upload site market.

Confucius Say...

[seven of five]

"He who trusts private data to remote host has head in cloud..."

Security-by-obscurity

[js_sebastian]

While you have a point that many security methods such as passwords rely on 'obscurity', one can still make a distinction between methods which rely on poorly measured (and typically low) entropy and methods which rely on well defined entropy. Usually when people talk about the dangers of security through obscurity, they are talking of the former;...

No. Security by obscurity means security achieved by keeping the details of your system secret (architecture, algorithms, etc), so people don't know how to break in. The accepted way to do security, on the other hand, is to build a system that is secure even against adversaries who know everything about your system, lacking only a well defined credential or set of credentials (a password, certificate, fingerprint, etc).

Using "secret" urls to provide access is not security by obscurity if there is enough randomness involved that urls are practically unguessable, though if it does not go over HTTPs it is certainly weak against certain threat models (Man-in-the-middle).