Slashdot Mirror
Software Developer Says Mega Master Keys Are Retrievable
hypnosec writes that software developer Michael Koziarski has released a bookmarklet
"which he claims has the ability to reveal Mega users' master key. Koziarski went on to claim that Mega has the ability to grab its users' keys and use them to access their files. Dubbed MegaPWN, the tool not only reveals a user's master key, but also gives away a user's RSA private key exponent. 'MEGApwn is a bookmarklet that runs in your web browser and displays your supposedly secret MEGA master key, showing that it is not actually encrypted and can be retrieved by MEGA or anyone else with access to your computer without you knowing,' reads an explanation about the bookmarklet on its official page."
Who would have thought that data stored in JavaScript could be grabbed.
I don't think there are many people who would trust Mega anyway. I mean, we all pretty much feel the US (and the New Zealand) governments overreached and broke laws when they begin prosecuting Kim DotCom, but most people realize that the guy is a self-aggrandizing scam artist and charlatan. Does anyone actually trust his stuff?
End to end encryption or it didn't happen.
Once you enter your password into a website, the website can do anything that you can do.... Duh
Yes, mega doesn't have your key stored on their servers.
Yes, at any point while you're logged in they can change this fact, or they can just log your password, or whatever.
Doesn't matter what the website is, you have to trust it to use it.
How is this news?
I don't get it, why is this a big deal? This just displays your local storage in your web browser.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
That's how you want it to be. It's zero-knowledge from MEGA's point of view. You generate your own key, keep it and use it to decrypt and encrypt stuff.
So of course if someone gets access to your computer they can get your key, it was on your computer all the time, by design.
His assertion that MEGA can get your key is what is a bit more surprising. But if you read it, he's simply saying it's conceptually possible that MEGA could use a script on their site to grab your key and send it to them. This is of course possible, but we have no way to know whether they've done it. If the javascript can access your key to encrypt/decrypt stuff, then it is also possible it can squirrel it away somewhere.
http://lkml.org/lkml/2005/8/20/95
Unless Im misreading it, this can be summarized as follows:
* Coder has discovered that, in order to encrypt data, your computer must have access to the encryption key
* Further, if someone has root access to your machine, they can get your encryption key.
Wow. What a discovery.
MEGA and anyone else with access to your computer can see this, and use it to decrypt any file you upload.
Wait, someone with access to my computer has access to things that my computer has access to? WOW!
So, the gnome-underwear schematic for Kim Dotcom:
1) Operate MegaVideo etc.
2) Get busted by massive international intel/police operation.
3) ???
4) Start new Mega supposedly-über-safe filesharing system, taking advantage of your new anti-establishment credibility that you earned in step (2) to convince everyone that you're fighting for privacy against the incursions of the Man.
5) Compromise all the accounts on Mega.
Not relevant. Not because it isn't timely, but because mega hasn't been important since ... megaupload.
Mega is? A bookmarklet is? This summary reads as gibberish to me.
Two back-to-back /. articles with the superlative "Mega" in the title. The next scientific discovery will need to be ÃoeberMega to reach the front page of /.
The problem with storing data in the cloud with encryption from the providers standpoint is that you can't use dedupe on it. Dedupe can make an extremely large difference in the amount of storage that you have to buy and run. From an operational costs standpoint the difference between running a data repository with and without dedupe could easily be the difference between running at a profit or a loss.
The service provider has a very strong financial incentive to use dedupe technology. The problem is that there is no way to run dedupe on crypto without having the key and being susceptible to having your data be accessed by third parties. If you don't have the key than you can honestly say that you have no idea what is in a users data set or ability to decrypt it, but you then lose the ability to dedupe the data and save a fortune on operational costs.
In a nutshell what you really need is a cloud provider that offers dedupe free storage. Their costs (read your costs) would be higher to offer this of course, but for many people that's more than reasonable when your asking them to incur additional expenses to actually keep your data private. I can't speak for Mega of course, but the dedupe question is one that could nail this down one way or another.
I worked for a company that wanted to offer secure cloud backup. A crucial requirement was that the company would never have the encryption key, and we went to significant lengths to do that. But the users wanted a way to download their files from the web. Well, how were we supposed to send the user a decrypted file if we didn't have the decryption key? Solution: The user must enter the key into the web app, then the server decrypts the file and sends it to them. So now, in theory, the company could simply store your key.
Whoops!
Ultimately, there really is no solution here other than to encrypt the files yourself. Whenever something is "secure" you have to ask "secure from whom?"
So this is obvious to anyone with knowledge of encryption. I believe Mega's claim is that because the encryption is done on the client side, they don't know the key. This could be true, but you still have to take their word for it.
But even though it's obvious, it's something to consider. Mega claims that they could not decrypt your files. This is demonstrably false. So what's to stop the government from serving them with a National Security Letter that forces them to add code to the login process, logging all keys upon login, without any advance warning to their customers?
There's essentially no way to trust a third party on the internet now without an alternate, reliable channel of communication to exchange keys in the first place.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
It might be helpful if you told your readers what a "mega master" key is so they know what it is you're so worried about. Googling Mega Master turns up a company in South Africa that sells heating equipment, a transportation company in Houston, TX, an online radio station, but nothing seems relevant.
If he was found in a dingy little basement with row upon row of servers. If he was still named (whatever he was called before dotcom) because he was too poor to afford the renaming fees, THEN I might distrust him a little less.
But honestly anyone with that name or house is pretty obviously trying to become part of the 1 percent, not take them down. (Or at least not without taking over their position.)
my luggage number is 742. One less thing to worry about.
It's not a question as to whether it's serious. It was always the case and could be assumed to be the case. If the JavaScript can get to your key to use it to encrypt/decrypt, it can also possibly upload. It's part-and-parcel of the design.
I pointed this out when MEGA was first announced. There always is the possibility of a system squirreling away your keys. You cannot design it out in software. The software reconstructs your key at some point, you then have to trust it discards after using it only for the use you requested it be used for.
I think the problem may be that you (and others) don't really understand what MEGA can promise and what they can actually deliver.
Anyway, you've now entered the realm of security paranoia. The only way to survive in this area is to review all the code you are going to put on your machine and to compile it yourself because if you don't, you don't know the delivered object matches the sources you reviewed. And don't forget to review all the code in the compiler(s) or interpreter(s) in play, because you verify they aren't inserting backdoors too.
After you get through all that, you only have to worry about whether your hardware (CPU) is inserting backdoors. There's no way to prove the CPU is actually executing the object code according to the spec unless you review every transistor in the CPU.
http://lkml.org/lkml/2005/8/20/95
I'd agree that this is not really a vulnerability in the traditional sense.... but under the circumstances, Mega should (IMO) do more to convince customers the data they store there isn't going to be viewed by any 3rd. parties.
Ultimately, I suppose a custom browser plug-in could be written which would divulge your secret personal key, too. But I'd rather see a less trivial process to upload a user's key than some basic javascript making it possible. (Otherwise, it's too easy to trick a user into visiting what he/she thinks is a landing page for Mega, but is actually a site designed to capture keys.)
Emphasis and clarification added. The problem isn't that the files aren't getting encrypted before upload, it's that *you* aren't doing it. Your browser, executing JS code from mega.co.nz, is doing it. You aren't even running the encryption program yourself; it's all automatic. You are handing Mega an un-encrypted file, and trusting them to securely encrypt it against themselves. Does this sound stupid yet? Let me be a little clearer: what does it matter whose actual CPU executes the crypto code, when Mega owns (and can change at any time) that code?
While Mega's approach is very convenient, it also throws all security guarantees out the window. From the user's perspective, they are giving an untrusted site ("untrusted" here is used in the security sense, as in "we are not absolutely sure that this site will not attempt to rat us out, so we are never going to let it see the unencrypted data") access to... unencrypted data. See the problem here? Yes, the version of the site's JS that you downloaded on this visit probably doesn't contain anything that leaks your decryption key to Mega, but there's no guarantee of that unless you audited the code yourself. Even then, it could be different next time...
Let me reiterate those points one more time:
1) You are handing Mega access to your plain-text data. It doesn't matter whose CPU modifies the data; Mega controls the code that runs on the CPU.
2) Because of item #1, all of Mega's guarantees are bullshit. The next time you visit their site, they could steal your keys and decrypt all your data; you can't stop them.
3) The only way to do this securely is, as amicusNYCL points out, encrypt them yourself. That means *not* using Mega's code, or the code of anybody else you are attempting to encrypt *against*.
There's no place I could be, since I've found Serenity...
...thanks for the huge back door up my ass, Kim.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
I read the title as "Software developer says Sega Master keys are retrievable".
Get free satoshi (Bitcoin) and Dogecoins
All the files I store on the Cloud are encrypted locally on my machine by GPG before being uploaded to Google Drive, Mega or whatever. Now it is possible that a backdoor/exploit of my OS's code or GPG's code or hardware could leak my keys, but that's significantly more difficult to accomplish than simply changing a few lines of JavaScript the next time my browser pulls down the uploader's page.
http://redd.it/1lnun3
I killed christopher 'aempirei' abad with my 5" dick
Cowabunga, dude!
And now you're going to die wearing that stupid little hat. How does it feel!?
You got caught with the seat of your pants flying down and now everyone laughs at your little picopenis on a daily basis.
Microchipping a fellow hacker just because you can't sniff out your own? Hilariously inept.
Throwing a well-known, contributing veteran of the hack/trollscene into a mental institution just because you had a hangover and forgot to take your klonopin? Over the top.
Having a wanton disregard for the history of the internet, the hackscene, trollscene and everything about humanity in general? Get a clue. Your holier-than-thou attitude can screw back off to the 1980's.
Yes, folks, christopher 'ambient empire' abad has been bitchtagging and torturing anyone that walks by him just because, well, "I feel like it!"
Yes, folks, christopher 'ambient empire' abad fails to understand the first rule of the U.S. system: you can always just buy people off with cash.
'
We've been talking to your friends, coworkers and they've been telling us what a lazy, unappreciative little shit you are. Not to mention a sociopath of the lowest order.
You won the birth lottery and coasted your way to the top of the U.S. system on a skateboard. Now it's going to be a fun ride when we push your little deck the way back down.
You are nothing but a barking little dog who got caught sneaking up the backstairs into the big people's club and now you're being thrown out the window.
Your last thought as you realize nothing of value will be lost when your head cracks on the floor of a 12x12 supermax prison cell: "I like to copy from my 1337 civics textbook."
Sayanora, sucker!
Malaclypse the Younger
http://pastie.org/8295259
they have developer documentation, and a c++ sdk as source code
https://mega.co.nz/sdk.zip
https://mega.co.nz/#dev
now stop posting and make a client!
The first time I read the headline it said "Software Developer says MegaMan Master keys are Retrievable" so I thought it in regards to was some kind of ROM DRM. Second time I read it, it said "Software Developer says Sega Mega Keys are retrievable". So I googled Sega Mega only find that the Sega Genesis (or some variation) was marketed with that name in some parts of the world. This made some sense, although didn't really seem to belong in YRO. Is my mind deteriorating faster than I expected or is the Illuminati **cking with me?
Definitely no surprise, as many others have already mentioned.
Raymond Chen's old post is still a good read in this context:
http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/592350.aspx
We knew this was an issue from when Mega was first launched. All this guy has done is made a pretty useless bookmarklet. Obviously if there is code on your computer that has access to the key and can be changed remotely then whoever can change the code can steal the key. Luckily Mega provides an API so this is a non-issue provided you use a client on your local computer.
I don't get why they are wasting time and money building their own client, especially when they appear to lack the will or skill to make it secure. What they could have done instead, for zero effort, would have been to support sftp with RSA keys. That would be as secure as it gets, work out of the box, and allow ease-of-use addons like sshfs. As it stands now, even their design is flawed. It runs a client but one from their server. It has access to the users' passwords and could even be swapped for a malicious client with no effort.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Soooo, in essence, the guy managed to verify WHERE in the browser Mega stores is Master Key?
The stuff is encrypted on the client side so of course you can see the key and obviously anyone with access to your computer can see it.
The problem lies in Javascript, so anyone (including MEGA) can write a browser addon which can read your key and send it to him BUT that implies you agreed to install that same addon. How many developers of addons you use would be interested in getting your MEGA master key ?? I think you're pretty much safe, unless MEGA decides they suddenly want your key. But that would completely defeat the purpose of client side encryption and equalize their service with countless other file storage providers, and I don't think that's something they want to do.
The news is useless, since any client side encryption in web browsers/javascript is vulnerable to this. The only solution is to avoid the web browser and use a desktop application for encryption and file uploads.