Skip Links

Doubt cast on the security of Kim Dotcom's Mega service

Mega officials admit they're JavaScript 'newbies' but say Mega is no more vulnerable than online banking sites to an attack

By Jeremy Kirk, IDG News Service
January 21, 2013 11:08 PM ET

IDG News Service - Kim Dotcom's bold new venture, the file-storage and sharing service Mega, is drawing criticism as security researchers analyze how the site protects users' data. In short, they advise: don't trust it.

While Mega officials admit they're "newbies" to JavaScript, the programming language used to execute key elements of their service, they say their website is no more vulnerable than online banking sites to attack.

Dotcom threw a large launch party for Mega on Sunday at his mansion outside of Auckland. The service is the successor to Megaupload, the file-sharing site that Dotcom and his colleagues were indicted for in the U.S. in January 2012 on copyright infringement charges.

The flamboyant Dotcom is assuring Mega's users that the site's encryption will protect their privacy and data, but the implementation of that encryption scheme is fundamentally flawed, observers allege.

Mega uses SSL (Secure Sockets Layer) a widely used protocol for encryption across the internet for securing the connection between its users' computers and its own servers. Once an SSL connection is made, Mega pushes JavaScript code to a person's browser, which then encrypts the person's files before the data is sent to Mega's servers.

The problem is that SSL has long been recognized as a weak point on the web. In 2009, security researcher Moxie Marlinspike created a tool called SSLstrip, which allows an attacker to intercept and stop an SSL connection. The attacker can then spy on whatever data the user sends to the fake website.

Since Mega fundamentally relies on SSL, "there is really no reason to be doing client-side encryption," Marlinspike said in an interview Monday. "These kind of schemes are vulnerable to all of the problems with SSL."

Someone who attacks Mega using SSLstrip could then send their own custom malicious JavaScript to the victim's browser. The user would inevitably divulge his password, which would allow the attacker to decrypt all his data stored with Mega.

Mathias Ortmann, Mega's CTO, said in an interview Monday that there are a variety of web-based attacks that Mega would be vulnerable to just like any other site that relies on SSL for security, such as for online banking. Those scenarios are outlined on Mega's site, he said.

"If they had bothered to read that they would have seen that we basically state exactly what they are accusing us of as possible attack vectors plus some others they are not accusing us of," said Ortmann. "All of these SSL-related attacks do no apply specifically to us. They apply to companies with equally high security requirements or even higher requirements."

SSL is underpinned by encrypted security certificates that are issued by authorized companies and organizations. But the issuing system has long been criticized since scammers have been able to obtain valid certificates for websites they don't own.

Ortmann acknowledged that someone could try to trick a certificate authority into issuing a real SSL certificate for mega.co.nz, which would allow the attacker to create a fake Mega website that appears to have proper credentials.

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News