Slashdot Mirror
Software Developer Says Mega Master Keys Are Retrievable
hypnosec writes that software developer Michael Koziarski has released a bookmarklet
"which he claims has the ability to reveal Mega users' master key. Koziarski went on to claim that Mega has the ability to grab its users' keys and use them to access their files. Dubbed MegaPWN, the tool not only reveals a user's master key, but also gives away a user's RSA private key exponent. 'MEGApwn is a bookmarklet that runs in your web browser and displays your supposedly secret MEGA master key, showing that it is not actually encrypted and can be retrieved by MEGA or anyone else with access to your computer without you knowing,' reads an explanation about the bookmarklet on its official page."
I don't think there are many people who would trust Mega anyway. I mean, we all pretty much feel the US (and the New Zealand) governments overreached and broke laws when they begin prosecuting Kim DotCom, but most people realize that the guy is a self-aggrandizing scam artist and charlatan. Does anyone actually trust his stuff?
Once you enter your password into a website, the website can do anything that you can do.... Duh
Yes, mega doesn't have your key stored on their servers.
Yes, at any point while you're logged in they can change this fact, or they can just log your password, or whatever.
Doesn't matter what the website is, you have to trust it to use it.
How is this news?
I don't get it, why is this a big deal? This just displays your local storage in your web browser.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
That's how you want it to be. It's zero-knowledge from MEGA's point of view. You generate your own key, keep it and use it to decrypt and encrypt stuff.
So of course if someone gets access to your computer they can get your key, it was on your computer all the time, by design.
His assertion that MEGA can get your key is what is a bit more surprising. But if you read it, he's simply saying it's conceptually possible that MEGA could use a script on their site to grab your key and send it to them. This is of course possible, but we have no way to know whether they've done it. If the javascript can access your key to encrypt/decrypt stuff, then it is also possible it can squirrel it away somewhere.
http://lkml.org/lkml/2005/8/20/95
Unless Im misreading it, this can be summarized as follows:
* Coder has discovered that, in order to encrypt data, your computer must have access to the encryption key
* Further, if someone has root access to your machine, they can get your encryption key.
Wow. What a discovery.
MEGA and anyone else with access to your computer can see this, and use it to decrypt any file you upload.
Wait, someone with access to my computer has access to things that my computer has access to? WOW!
Two back-to-back /. articles with the superlative "Mega" in the title. The next scientific discovery will need to be ÃoeberMega to reach the front page of /.
The problem with storing data in the cloud with encryption from the providers standpoint is that you can't use dedupe on it. Dedupe can make an extremely large difference in the amount of storage that you have to buy and run. From an operational costs standpoint the difference between running a data repository with and without dedupe could easily be the difference between running at a profit or a loss.
The service provider has a very strong financial incentive to use dedupe technology. The problem is that there is no way to run dedupe on crypto without having the key and being susceptible to having your data be accessed by third parties. If you don't have the key than you can honestly say that you have no idea what is in a users data set or ability to decrypt it, but you then lose the ability to dedupe the data and save a fortune on operational costs.
In a nutshell what you really need is a cloud provider that offers dedupe free storage. Their costs (read your costs) would be higher to offer this of course, but for many people that's more than reasonable when your asking them to incur additional expenses to actually keep your data private. I can't speak for Mega of course, but the dedupe question is one that could nail this down one way or another.
yeah something you run on your browser.. ..that gives you access to the files.. CAN GIVE YOU ACCESS TO THE FILES.
wow what a shock! because in this case, MEGA can alter the js so that they get the keys. how this is is news I don't really get. it's just common sense.
the real question is, are there 3rd party mega clients that are not javascript or subject to changing without notice..
world was created 5 seconds before this post as it is.
I worked for a company that wanted to offer secure cloud backup. A crucial requirement was that the company would never have the encryption key, and we went to significant lengths to do that. But the users wanted a way to download their files from the web. Well, how were we supposed to send the user a decrypted file if we didn't have the decryption key? Solution: The user must enter the key into the web app, then the server decrypts the file and sends it to them. So now, in theory, the company could simply store your key.
Whoops!
Ultimately, there really is no solution here other than to encrypt the files yourself. Whenever something is "secure" you have to ask "secure from whom?"
So this is obvious to anyone with knowledge of encryption. I believe Mega's claim is that because the encryption is done on the client side, they don't know the key. This could be true, but you still have to take their word for it.
But even though it's obvious, it's something to consider. Mega claims that they could not decrypt your files. This is demonstrably false. So what's to stop the government from serving them with a National Security Letter that forces them to add code to the login process, logging all keys upon login, without any advance warning to their customers?
There's essentially no way to trust a third party on the internet now without an alternate, reliable channel of communication to exchange keys in the first place.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
It's not a question as to whether it's serious. It was always the case and could be assumed to be the case. If the JavaScript can get to your key to use it to encrypt/decrypt, it can also possibly upload. It's part-and-parcel of the design.
I pointed this out when MEGA was first announced. There always is the possibility of a system squirreling away your keys. You cannot design it out in software. The software reconstructs your key at some point, you then have to trust it discards after using it only for the use you requested it be used for.
I think the problem may be that you (and others) don't really understand what MEGA can promise and what they can actually deliver.
Anyway, you've now entered the realm of security paranoia. The only way to survive in this area is to review all the code you are going to put on your machine and to compile it yourself because if you don't, you don't know the delivered object matches the sources you reviewed. And don't forget to review all the code in the compiler(s) or interpreter(s) in play, because you verify they aren't inserting backdoors too.
After you get through all that, you only have to worry about whether your hardware (CPU) is inserting backdoors. There's no way to prove the CPU is actually executing the object code according to the spec unless you review every transistor in the CPU.
http://lkml.org/lkml/2005/8/20/95
What the hell is mega, other than a prefix?
I'd agree that this is not really a vulnerability in the traditional sense.... but under the circumstances, Mega should (IMO) do more to convince customers the data they store there isn't going to be viewed by any 3rd. parties.
Ultimately, I suppose a custom browser plug-in could be written which would divulge your secret personal key, too. But I'd rather see a less trivial process to upload a user's key than some basic javascript making it possible. (Otherwise, it's too easy to trick a user into visiting what he/she thinks is a landing page for Mega, but is actually a site designed to capture keys.)
Oh noes, the pestilent scourges, the one percent!!!!
Emphasis and clarification added. The problem isn't that the files aren't getting encrypted before upload, it's that *you* aren't doing it. Your browser, executing JS code from mega.co.nz, is doing it. You aren't even running the encryption program yourself; it's all automatic. You are handing Mega an un-encrypted file, and trusting them to securely encrypt it against themselves. Does this sound stupid yet? Let me be a little clearer: what does it matter whose actual CPU executes the crypto code, when Mega owns (and can change at any time) that code?
While Mega's approach is very convenient, it also throws all security guarantees out the window. From the user's perspective, they are giving an untrusted site ("untrusted" here is used in the security sense, as in "we are not absolutely sure that this site will not attempt to rat us out, so we are never going to let it see the unencrypted data") access to... unencrypted data. See the problem here? Yes, the version of the site's JS that you downloaded on this visit probably doesn't contain anything that leaks your decryption key to Mega, but there's no guarantee of that unless you audited the code yourself. Even then, it could be different next time...
Let me reiterate those points one more time:
1) You are handing Mega access to your plain-text data. It doesn't matter whose CPU modifies the data; Mega controls the code that runs on the CPU.
2) Because of item #1, all of Mega's guarantees are bullshit. The next time you visit their site, they could steal your keys and decrypt all your data; you can't stop them.
3) The only way to do this securely is, as amicusNYCL points out, encrypt them yourself. That means *not* using Mega's code, or the code of anybody else you are attempting to encrypt *against*.
There's no place I could be, since I've found Serenity...
...thanks for the huge back door up my ass, Kim.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Its fucking Kim Dotcom's new site. If you don't know what "Mega" means in this context you don't need to know.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Other people will comment, but just to run over the carcass in my new LandRover s'more; Mega is Kim Dotcom's new file storage site.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
I read the title as "Software developer says Sega Master keys are retrievable".
Get free satoshi (Bitcoin) and Dogecoins
The bright thing in front of you is called a computer monitor. It displays information from your computer. Your computer is a machine which can execute instructions, called "programs", to compute or manipulate data. The output of these programs is typically displayed on the monitor. The inputs to these programs, and most of the programs themselves, come from a variety of sources outside of your computer. These sources include yourself, other computers which your computer is connected to, and data storage devices which can be written to by one computer, moved to your computer, and then read from. Let's start with the first source, yourself. You interact with the computer via various mechanisms, typically called "input devices". The most common input devices are the mouse (usually fits in one hand, has a few buttons on one end) and the keyboard (typically placed directly in front of you, it is wide and has many buttons, most of which are labeled with letters or numbers).
There's no place I could be, since I've found Serenity...
yeah something you run on your browser.. ..that gives you access to the files.. CAN GIVE YOU ACCESS TO THE FILES.
wow what a shock! because in this case, MEGA can alter the js so that they get the keys. how this is is news I don't really get. it's just common sense.
the real question is, are there 3rd party mega clients that are not javascript or subject to changing without notice..
What is common sense to anyone who understands how a service is built is not necessarily common sense to those who use it.
So it matters.
"Mega" is a file sharing site, started in place of the now-defunct MegaUpload, purported to be secure against even themselves. This article is to show that there is exactly zero effective security against data breaches by Mega.
A "bookmarklet" is a bookmark that rather than storing a URL, stores a snippet of javascript, which gets run in-place on the currently loaded web page, altering it in some fashion. Think GreaseMonkey, but without the framework to automatically run the scripts on certain sites.
All the files I store on the Cloud are encrypted locally on my machine by GPG before being uploaded to Google Drive, Mega or whatever. Now it is possible that a backdoor/exploit of my OS's code or GPG's code or hardware could leak my keys, but that's significantly more difficult to accomplish than simply changing a few lines of JavaScript the next time my browser pulls down the uploader's page.
I got your 3:
3) Call them out on their bullshit tactics and techniques
FC Closer
The first time I read the headline it said "Software Developer says MegaMan Master keys are Retrievable" so I thought it in regards to was some kind of ROM DRM. Second time I read it, it said "Software Developer says Sega Mega Keys are retrievable". So I googled Sega Mega only find that the Sega Genesis (or some variation) was marketed with that name in some parts of the world. This made some sense, although didn't really seem to belong in YRO. Is my mind deteriorating faster than I expected or is the Illuminati **cking with me?
If he was found in a dingy little basement with row upon row of servers. If he was still named (whatever he was called before dotcom) because he was too poor to afford the renaming fees, THEN I might distrust him a little less.
But honestly anyone with that name or house is pretty obviously trying to become part of the 1 percent, not take them down. (Or at least not without taking over their position.)
That's an unfair attack on Kim! He's not trying to become part of th 1%; he's obviously attempting to start up an alternate 0.1%....
We knew this was an issue from when Mega was first launched. All this guy has done is made a pretty useless bookmarklet. Obviously if there is code on your computer that has access to the key and can be changed remotely then whoever can change the code can steal the key. Luckily Mega provides an API so this is a non-issue provided you use a client on your local computer.
I don't get why they are wasting time and money building their own client, especially when they appear to lack the will or skill to make it secure. What they could have done instead, for zero effort, would have been to support sftp with RSA keys. That would be as secure as it gets, work out of the box, and allow ease-of-use addons like sshfs. As it stands now, even their design is flawed. It runs a client but one from their server. It has access to the users' passwords and could even be swapped for a malicious client with no effort.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Soooo, in essence, the guy managed to verify WHERE in the browser Mega stores is Master Key?
the real question is, are there 3rd party mega clients that are not javascript or subject to changing without notice..
Not if you disable auto-updates from Mega.