Several top E2EE cloud storage providers have serious security flaws

A compromised server could be abused, researchers say

News By Sead Fadilpašić published 21 October 2024

Some cloud storage providers offering end-to-end encryption (E2EE) are largely operating a broken ecosystem which could, in very realistic theory, allow threat actors to tamper with the files in a way that should not be possible, experts have claimed.

In an in-depth analysis, recently published on the brokencloudstorage.info website, cybersecurity researchers Jonas Hofmann and Kien Tuong Truong from ETF Zurich noted if a threat actor compromises a company server, they can “inject files, tamper with file data, and even gain direct access to plaintext."

During their research, the two experts analyzed five major providers in the field - Sync, pCloud, Icedrive, Seafile, and Tresorit, concluding, “many of our attacks affect multiple providers in the same way, revealing common failure patterns in independent cryptographic designs."

Nation-state targets

On Sync and pCloud, a compromised server could be abused to break the confidentiality of uploaded files, inject files, and tamper with their content, while for Seafile such a server could be used to speed-up brute-force attacks, inject files, and tamper with the content.

For Icedrive, hackers could use a compromised server to break the integrity of uploaded files, inject files, and tamper with their content, while for Tresorid, a broken server could be used to present non-authentic keys, when sharing files. Crooks would also be able to tamper with some metadata in the storage.

The researchers stress that this doesn’t mean that the service providers are malicious, but that these flaws make them a major target for threat actors. More importantly - nation-state threat actors. They also added that compromising a server belonging to an E2EE cloud storage provider isn’t as far-fetched as it may seem at first.

In fact, they argue it’s the “most realistic” adversary model for E2EE cloud storage.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors