4 ms·
> MEGA can recover a user's RSA private key by maliciously tampering with 512 login attempts. I think this attack is really interesting and novel, but 512 logi
by Shank 4y ago
> MEGA can recover a user's RSA private key by maliciously tampering with 512 login attempts.
I think this attack is really interesting and novel, but 512 login attempts is pretty high. I have a Mega account and I think I've logged in less than 50 times in the entire lifetime of my account, including when it was still controlled by Kim Dotcom. If you're an interesting enough target to use this on, I don't see why the Mega server that delivers the javascript for encryption can't be compromised instead, and just harvest the passphrase when it's submitted to login the first time?
I don't know what you'd have to do to convince someone to login 512 times via social engineering, either. Presumably, a user who is dedicated and uses the service on a daily basis might hit this through normal usage in a year and a half? That's definitely plausible, but how many users are initiating new logins each time? How many will just stay logged into the app and never login?
I guess for some percentage of people (e.g., people who are logging in each time via Tails, and do it twice a day) this attack is acutely viable, but it surely can't be all users.
- sp332 4y agoMega controls the client side too, right? So when you put your password into the app, they can make 512 logins right then.
- meibo 4y agoThey could also just upload the password and the key material, so in the end this is about them being able to do it in a way that isn't obvious to everyone looking at the network tab, which is the real issue being pointed out.
- albatruss 4y agoTheir MEGAsync client is open source at least.
- projektfu 4y agoAre the binaries reproducibly built?
- megous 4y agoNo they don't, unless you use their website.
- tptacek 4y ago512 login attempts is nothing. The Bleichenbacher'98 padding oracle attack is sometimes called "the million message attack", and it's one of the more practical crypto attacks --- I've been on projects that deployed that attack adversarially to accomplish things.
- herendin 4y agoThese are apparently login attempts visible to the user. To conceal them might be possible in some cases, but requires tampering suspiciously with public source client-side apps
- tptacek 4y agoThe server can just accept the SID the client "decrypted" with the malicious RSA key, and run the attack over time. This is right there in the paper. This isn't a cryptosystem, it's a CTF level.
- herendin 4y agoPut simply: this attack required the user to enter the password 512 times[0] [0] https://mega-awry.io/#questions https://mega-awry.io/#questions
- tptacek 4y agoPut simply: this attack required the user to log in 512 times, ever. You don't have to take my word for it; that's how Mega summarizes the attack in their response.
- herendin 4y agoThe point is this exploit, according to the researchers, required massive and unusual manual intervention by the user, so it's very different from the other exploit you mentioned that involves millions of auth attempts From the link I just posted, written by the researchers: 'Nevertheless, on the clients that we analyzed, all attacks would have required a substantial number of manual login attempts (i.e., the user entering the password). Since clients usually cache the credentials, users often stay logged in, minimizing the number of logins performed and thereby increasing the difficulty of the attacks.'
- rootw0rm 4y agoI've used corporate systems which made u login every visit (multiple times a day for me, 5 days a week), I've seen government systems do it, there might be a surprising number of targets where 512 attempts is effective
- ASalazarMX 4y ago> I have a Mega account and I think I've logged in less than 50 times in the entire lifetime of my account, including when it was still controlled by Kim Dotcom. Same experience here. I've logged in maybe once per year, if it suddenly started asking me to login every time I used it, it would be a huge red flag.