Attacks on MEGA Contact Relationships
K.J. Kiisa (TU Delft - Electrical Engineering, Mathematics and Computer Science)
K. Liang – Mentor (TU Delft - Cyber Security)
H. Chen – Mentor (TU Delft - Cyber Security)
More Info
expand_more
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
MEGA is a popular cloud storage provider in both commercial and consumer markets [2][1]. MEGA claims to provide secure storage, in a threat model where even the storage provider should be unable to tamper with a user’s data undetected [5]. Previous work by Backendal et. al., as well as other follow-up research works, discovered several attacks that an adversarial storage provider could perform to covertly read and write a user’s storage [7]. MEGA’s patches to the attacks solve the initial attacks that allow for the attack chain to take place, but did not solve the fundamental problems in the security architecture that enabled these attacks [6]. This work provides 5 attacks on user’s contact relationships and folder sharing, that even after the patches, allow for an adversarial storage provider to manipulate a user’s contact list, and forge data in their secure storage.