{"id":101369,"date":"2024-11-01T16:01:49","date_gmt":"2024-11-01T16:01:49","guid":{"rendered":"https:\/\/www.cloudcomputing-news.net\/?p=101369"},"modified":"2024-11-01T16:01:49","modified_gmt":"2024-11-01T16:01:49","slug":"security-gaps-found-in-encrypted-cloud-storage-services","status":"publish","type":"post","link":"https:\/\/www.cloudcomputing-news.net\/news\/security-gaps-found-in-encrypted-cloud-storage-services\/","title":{"rendered":"Security gaps found in encrypted cloud storage services"},"content":{"rendered":"\n

Researchers from ETH Zurich have uncovered significant security vulnerabilities<\/a> in several widely used end-to-end encrypted (E2EE) cloud storage services.<\/p>\n\n\n\n

The cryptographic flaws could allow attackers to bypass encryption, compromise file confidentiality, tamper with data, or even inject unauthorised files into users\u2019 storage.<\/p>\n\n\n\n

The study analysed five E2EE cloud storage providers\u2014Sync, pCloud, Seafile, Icedrive, and Tresorit\u2014which collectively serve an estimated 22 million users worldwide. Each of the services promises robust encryption to safeguard files from unauthorised access, even by the service provider.<\/p>\n\n\n\n

However, researchers Jonas Hofmann and Kien Tuong Truong discovered that four of the five have severe flaws that might weaken protections. Presented at the ACM Conference on Computer and Communications Security (CCS), their findings highlight potential gaps in the E2EE security promises made by providers.<\/p>\n\n\n\n

Tresorit stands out but isn\u2019t flawless<\/h3>\n\n\n\n

Of the services tested, Tresorit demonstrated the fewest vulnerabilities, with only minor risks of metadata tampering and non-authentic keys during file sharing. Although less severe, these issues could still pose risks in certain scenarios. In contrast, the other four services exhibited more substantial security gaps, increasing the chances of data exposure or tampering.<\/p>\n\n\n\n

Key vulnerabilities and realistic threats to E2EE<\/h3>\n\n\n\n

To evaluate the strength of E2EE security, researchers tested ten different attack scenarios, assuming the attacker had already gained control over a cloud server with permissions to read, modify, or inject data. Though this level of access is unlikely, the study contends that E2EE should be effective even under such conditions. Some notable vulnerabilities are:<\/p>\n\n\n\n