Several top E2EE cloud storage providers have serious security flaws

Some cloud storage providers offering end-to-end encryption (E2EE) are largely operating a broken ecosystem which could, in very realistic theory, allow threat actors to tamper with the files in a way that should not be possible, experts have claimed.

In an in-depth analysis, recently published on the brokencloudstorage.info website, cybersecurity researchers Jonas Hofmann and Kien Tuong Truong from ETF Zurich noted if a threat actor compromises a company server, they can “inject files, tamper with file data, and even gain direct access to plaintext.”

During their research, the two experts analyzed five major providers in the field – Sync, pCloud, Icedrive, Seafile, and Tresorit, concluding, “many of our attacks affect multiple providers in the same way, revealing common failure patterns in independent cryptographic designs.”

Nation-state targets

On Sync and pCloud, a compromised server could be abused to break the confidentiality of uploaded files, inject files, and tamper with their content, while for Seafile such a server could be used to speed-up brute-force attacks, inject files, and tamper with the content.

For Icedrive, hackers could use a compromised server to break the integrity of uploaded files, inject files, and tamper with their content, while for Tresorid, a broken server could be used to present non-authentic keys, when sharing files. Crooks would also be able to tamper with some metadata in the storage.

The researchers stress that this doesn’t mean that the service providers are malicious, but that these flaws make them a major target for threat actors. More importantly – nation-state threat actors. They also added that compromising a server belonging to an E2EE cloud storage provider isn’t as far-fetched as it may seem at first.

In fact, they argue it’s the “most realistic” adversary model for E2EE cloud storage.

The majority of the service providers mentioned in the report – Sync, Seafile, and Tresorit, were said to have acknowledged the report. Icedrive is yet to address the issue, while there are no reports for pCloud just yet.

Via The Hacker News