IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Venafi predicts €10,000 Mega bounty will be paid out

Encryption firm calls out Kim Dotcom’s approach to security as “bizarre".

Open padlock key

Enterprise security firm Venafi claims Kim Dotcom's offer of 10,000 for the first person to crack his new Mega file storage site will be collected.

The challenge was announced through the site's blog in response to criticism over its security procedures, including the fact there is no end-to-end encryption.

In its response to the challenge, Venafi added its own criticism, stating that - as the encryption keys are stored along with the users' files on the system - user data was more vulnerable.

Calum MacLeod, EMEA director at Venafi, said: "This bizarre and, quite frankly, less secure approach to encryption seems to be in place solely to protect Mr Dotcom from prosecution, on the basis that he and his staff cannot have any knowledge of the data that is being stored on their cloud computing servers.

"While this is perhaps understandable given the fact that [he] was arrested in New Zealand 12 months ago in connection with copyright infringement surrounding his original MegaUpload file storage and sharing service, the lack of security surrounding the encryption keys leaves the system vulnerable."

Mega's password system also came in for criticism from MacLeod, as users have the double burden of supporting account authentication without disclosing that password to Mega's servers as well as outer level data encryption.

This approach, he claims, is a weak security system because obtaining the master key is based on a simple token system that can be replayed, rather than the more usual secure challenge/response technology seen on commercial services.

"This weakness could be exploited through the use of a timing vulnerability when the server compares the user's hash data, allowing a hacker to progressively learn how to access the system using multiple attempts," he said.

"We fully expect this methodology to be exploited by would-be crackers wanting to collect the 10,000 bounty," MacLeod concluded.

Featured Resources

Big data for finance

How to leverage big data analytics and AI in the finance sector

Free Download

Ten critical factors for cloud analytics success

Cloud-native, intelligent, and automated data management strategies to accelerate time to value and ROI

Free Download

Remove barriers and reconnect with your customers

The $260 billion dollar friction problem businesses don't know they have

Free Download

The future of work is already here. Now’s the time to secure it.

Robust security to protect and enable your business

Free Download

Most Popular

How to secure your hybrid workforce
Advertisement Feature

How to secure your hybrid workforce

23 Sep 2022
What your hybrid workforce needs from their laptops
Advertisement Feature

What your hybrid workforce needs from their laptops

21 Sep 2022
Why collaboration is key to digital transformation
Sponsored

Why collaboration is key to digital transformation

13 Sep 2022