File-hosting Sites Not a Safe Haven For Private Data

An anonymous reader tips a story at the Register, according to which "Academic researchers say they've uncovered weaknesses in dozens of the most popular file hosting sites that allow people to gain unauthorized access to data that's supposed to be available only to those selected by the user."

Encryption

[igreaterthanu]

Why would you upload private data to some file hosting site? These (e.g. RapidShare) aren't the kind of services where you can modify files after uploading (such as Dropbox), so encryption is not much of a hassle. You have no reason not to encrypt the files before uploading them.

Re:Bogus

[Beryllium Sphere(tm)]

At a guess, an embedded URL that's loaded automatically when someone opens the document, for example an IMG tag.

How about

[Dyinobal]

How about Mediafire? All those other sites seem like general file hosting sites, media fire always seemed to me to lean itself towards personal storage, and private if you choose not to share it. If I recall you have to choose to share each folder/item instead of it being shared automatically. They looked at the most popular sites but what makes those sites more popular is the public sharing aspect.

Re:Bogus

[Opyros]

I suspect it means a Web bug, aka a Web beacon [webopedia.com].

Re:Encryption

[wvmarle]

Many people for some reason think it's safe because the site says they will protect your data.

Well maybe they can protect your data and will do some effort for it, the fact is you're putting your data on someone else's computer. The owner of that system (basically anyone with high enough privileges or physical access to the system) can access your data. They not necessarily will, but they can. And that little factoid is enough to make it insecure.

That such file hosting sites may have additional security holes allowing access to data one shouldn't have access too, is not important any more. When it's out of your controlled environment, the data is out of your control.

The only way to use remote hosting securely is to either own and directly control the remote hosting site by yourself, or to encrypt everything before it leaves your controlled environment, and keep the secret key to yourself. It's as simple as that. I'm wondering why this is even considered news here.

Re:Encrypt Everything Private

[TheEyes]

But in order to actually use encrypted data, it has to be decrypted at some point, so the rootkit just needs to wait for you to decrypt it. In the case of say, full disk encryption, this is rather easy.

The idea is that you encrypt the file you send to the filesharing site, that way when the filesharing site is hacked all the attackers get is an encrypted file. In fact this is a "perfect" use for data encryption: the file is never decrypted on the remote machine, only on your local one, so stealing the data off the remote site can never give an attacker access to anything but cyphertext.

Security-by-obscurity

[js_sebastian]

While you have a point that many security methods such as passwords rely on 'obscurity', one can still make a distinction between methods which rely on poorly measured (and typically low) entropy and methods which rely on well defined entropy. Usually when people talk about the dangers of security through obscurity, they are talking of the former;...

No. Security by obscurity means security achieved by keeping the details of your system secret (architecture, algorithms, etc), so people don't know how to break in. The accepted way to do security, on the other hand, is to build a system that is secure even against adversaries who know everything about your system, lacking only a well defined credential or set of credentials (a password, certificate, fingerprint, etc).

Using "secret" urls to provide access is not security by obscurity if there is enough randomness involved that urls are practically unguessable, though if it does not go over HTTPs it is certainly weak against certain threat models (Man-in-the-middle).