7 ms·

Kim Dotcom puts up €10,000 bounty for first person to break Mega's security

70 points by skeletonjelly 14y ago

incision 14y ago
It could be a standing offer with a hole found every other month and they'd be paying far less than the going rate for a quality, full-time security consultant. Better yet, they get to indirectly watch, learn from and adapt to bounty hunters work and only pay out if someone stays fully ahead of them.
- eridius 14y ago
  This is precisely why this is nothing more than a PR stunt meant to combat the people criticizing Mega's security. Mega is probably secure enough that anyone who is capable of breaking it doesn't need to do so publicly for a 10k Euro bounty, but would either be working for a government, or doing black hat work.
  - nikcub 14y ago
    and "they" don't need to break the encryption, they just need to steal a users password
- dpeck 14y ago
  It doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team. Its one of those things that doesn't scale all that well, one really talented tester can gain a deep understanding of an app and find loads and loads of opportunities for attack. Most bounty bug hunters on the other hand are hard to distinguish from usual internet background noise. Veracode recently put up an infograpic on bounty programs that was kind of interesting, http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-the-internet-safe-infographic/ http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-th...
  - incision 14y ago
    >I believe bounty programs are good, but they aren't a replacement for an actual security team. Of course not, I don't mean to suggest that it is. I'm suggesting that this is marketing with potential for cheap labor more than a real commitment to security.
ck2 14y ago
Isn't he a billionaire? Have you see the photos of his home? He might want to make the reward slightly higher than what the black market will pay out.
- VonGuard 14y ago
  Dunno why you were downvoted. Yer very right. People just don't talk about it this loud.
  - corin_ 14y ago
    He was down voted for illogically raising the wealth of Dotcom. By all means argue that it's too low, but the decision for this cost should come from the company's financials and the potential benefits of that spend, not the size of the house its owner lives in.
    - ck2 14y ago
      I mention his wealth because it's specifically from his business and offers a comparison to his ability to pay for security fixes that threaten the very operation of such business. It's like saying hey this business is worth $100k a day to me but I'm only willing to pay $10k to anyone who can show me a problem that would expose all my customers and bring it to a halt, perhaps permanently if the data got into the wrong hands, foreign governments, etc.
      - chaz 14y ago
        A business can't go to the founder as its own piggybank to get out of bad decisions. It's not only a legal and accounting nightmare, but it's bad for the business, too.
        VonGuard 14y ago
        I didn't really care about who has what money. I just agreed with his point that 10k doesn't beat the black market for something this high profile.
mike_herrera 14y ago
> It's been seven busy days for us since MEGA went live. As millions of users were hitting 50,000 freshly written and barely tested lines of code and dozens of newly installed servers, teething troubles were inevitable. -- Mega blog entry #4 If I were a gambler, my money would be on an infrastructure/man-in-the-middle or social-engineering attack vector. The people are likely stressed and the code is admittedly troublesome. Godspeed.
- scottbartell 14y ago
  "50,000 freshly written and barely tested lines of code"... it sounds like they're doing it wrong.
  - notimetorelax 14y ago
    Considering their success so far I wouldn't be so sure.
  - jaggederest 14y ago
    In my opinion, code is never fully tested unless it's produced under extreme clean room conditions (i.e. autopilots, nuclear plant software, space shuttle softwware), or has been used in production for a fair amount of time. Even if your code has full path coverage, you're almost certainly going to interact with an unpredictable outside world that can cause code to fail in novel and interesting ways.
    - DanBC 14y ago
      > Even if your code has full path coverage, you're almost certainly going to interact with an unpredictable outside world that can cause code to fail in novel and interesting ways. Yes. (http://www.f-22raptor.com/news_view.php?nid=267 http://www.f-22raptor.com/news_view.php?nid=267) > Don Shepperd told CNN Television that the onboard navigation, communications and fuel systems crashed as the planes crossed the International Date Line. > The problem seems to have arisen not from the time change, but from the change in longitude from W179.99 degrees to E180 which occurs on the International Date Line. > The USAF refused to specify the cause of the issue saying only that the aircraft "experienced a software problem involving the navigation system en route from Hickam to Kadena". The Wikipedia article List of Software Bugs has some other scary examples of billion dollar systems destroyed, or people killed, by bugs. (http://en.wikipedia.org/wiki/List_of_software_bugs http://en.wikipedia.org/wiki/List_of_software_bugs)
nwh 14y ago
If anything, it'll be an attack against their entropy gathering (mouse movements) or a mis-implemented encryption spec. Given the number of XSS holes in the site, I bet someone will be claiming that bounty soon.
sschueller 14y ago
He should have the reward go up every month it is not claimed.
nu2ycombinator 14y ago
mega-search.me already looks like having problems.
enoch_r 14y ago
Why does Mega's security matter to Mega? It seems like they've implemented encryption to provide plausible deniability that they're knowingly hosting pirated content, not to actually protect the privacy of users, the vast majority of whom will not be uploading confidential data.
- DanBC 14y ago
  Some pirates are paranoid. That's why Usenet providers[1] started offering encrypted Usenet. [1] EG Giganews, 2006 (http://www.giganews.com/news/article/encrypted-usenet.html http://www.giganews.com/news/article/encrypted-usenet.html)
- aw3c2 14y ago
  It's cheap advertisements for non-hackers. "It is so secure they een ran a contest to crack it!"
tptacek 14y ago
http://www.schneier.com/crypto-gram-9902.html#snakeoil http://www.schneier.com/crypto-gram-9902.html#snakeoil See: Warning sign #9. Read the whole thing, of course. Holding a contest doesn't make it snake oil...
- eps 14y ago
  Right. Someone obviously needs to utter "snake oil" when there is a mention of a peer review invitation that involves a bounty.
- hayksaakian 14y ago
  Because Google chrome is snake oil. Last I heard they still give regular bounties to people who submit major security bugs.
  - DanBC 14y ago
    Google offer payments for bugs as a small thank you to people who report bugs. Google accepts that all code has bugs, and they want help to close those bugs. Mega is offering a prize for breaking their crypto. They hope to never pay it out, and they hope to use that as a sales line - "SUPER SECURE CRYPTO NEVER BROKEN!!".
    - nextparadigms 14y ago
      Google also offers "prizes" in the same way at Pwnium.
- huhtenberg 14y ago
  Your comment makes no sense, of course. You point at a specific item only to say that this item doesn't apply as is. Why pointing at it then? Mega's security effort may very well be disingenuous, but what you wrote comes across as a snobbery.
  - jgeralnik 14y ago
    He didn't say the item doesn't apply, he said that it is a warning sign. Holding a contest doesn't make a product snake oil, but it certainly correlates to snake oil products.
ForFreedom 14y ago
only 10K?
Attocs 14y ago
does this have anything to do with me getting a 403 from http://kim.com/mega/ http://kim.com/mega/ ??
jpxxx 14y ago
The hell he'll ever be cutting a check. This is nonsense. And are people seriously using this service? It's like renting a cardboard safe deposit box in a bad neighborhood.
- genwin 14y ago
  Add TrueCrypt (easy) and it's 50GB of free secure cloud storage.
  - jpxxx 14y ago
    ... the use of which drives attention, legitimacy, and revenue to a scumbag.
    - genwin 14y ago
      Make sure to apply the same standards to all the companies and people (including half of Americans) getting away with much worse.
      - jpxxx 14y ago
        It's conceptually easier to go through life avoiding brazen bastards than three quarters of humanity.
chris_wot 14y ago
Look, it's pretty simple. Kim Dotcom is a snake oil salesperson. Great at hype, but ultimately if you dig beneath the covers I suspect there will be nothing there. I should know, I trusted and was very badly burned by someone who spoke big, manipulated others an dultimately had nothing whatsoever other than charm and chutzpah. Give Mega a wide berth, or you too could be badly burned. Someone else has also pointed to the following article about crypto-breaking contests, written by BrucebScneier. Definitely worth a read before getting excited about this contest. http://www.schneier.com/crypto-gram-9812.html#1 http://www.schneier.com/crypto-gram-9812.html#1
- ramblerman 14y ago
  "I should know, I trusted and was very badly burned by someone who spoke big, manipulated others an dultimately had nothing whatsoever other than charm and chutzpah. Give Mega a wide berth, or you too could be badly burned." Unless that person was Kim Dotcom this is useless diatribe. It is akin to me saying, "I had a bitter divorce so never marry"
  - sturgill 14y ago
    For the record, (and as someone who is happily married) I would discourage marrying kids. It's better to wait until both of you are at least 18...
SomeSpectackle 14y ago
Capture the keystrokes & mouse movements used to supplement entropy for the in-the-browser. Recently, the Internet Explorer vulnerability exposed the fact that any webpage can see all mouse movements. MiTM
- vincentkriek 14y ago
  How would this be a man in the middle attack? You should be able to record it yes but as you said keystrokes & mouse movements are used to SUPPLEMENT entropy, as in they also use other entropy.
  - nwh 14y ago
    They aren't using anything but that and `rand()`. They could use the Crypto library in Webkit, but they're not.
- pfortuny 14y ago
  Ok, just do it.
kayoone 14y ago
Kim Schmitz is known for screwing people alot of Times, so if you try your luck with this keep that in mind. Endeavors where he took others peoples Money in Return for nothing or didnt Pay Prize money: Ultimate Rally Kimvestor (letsbuyit.com) Osama bin Laden bounty Trendax AI trading company Liga.net Gaming League (around 1999)
- Dylan16807 14y ago
  Let's see. Ultimate Rally - never got past the planning stage, who did he take money from? letsbuyit.com - He said he was going to invest and then didn't. He never promised money to the people that lost it here, they were just speculators. Yes it was illegal, but he didn't breach any agreements. (Actually might not have been illegal at the time) bin Laden bounty - nobody gave him information leading to finding bin laden so there is no bounty, I don't see the problem here Trendax - well that's clearly a scam but I can't find if people actually invested there Liga.net - please tell me I missed something and you didn't put this on the list for cheating in a video game
  - kayoone 14y ago
    I just wanted to point out that he is/was a shady person and people should be cautious dealing with him. To adress your points: Ultimate Rally - afaik there where some poeple on forums that paid a significant entry fee and didnt get it back letsbuyit.com - clearly illegal, insider trading and he got a prison sentence + 100k fine Bin Laden bounty - true, but it still was smelly Liga.net - it was a Quake2 Duel League back in 98/99 (if i remember correctly). Kimble was known for playing lots of Quake back in the day, he invited the most promiment players, first prize was some super High end PC (of the time) and money but the winner never got it and was kicked out of the league, which was shutdown soon after that : http://planetquake.gamespy.com/fullstory.php?id=61507 http://planetquake.gamespy.com/fullstory.php?id=61507 Its just a fact that you should not trust this guy given his history. Sure people change, but be cautios! more info: http://www.theregister.co.uk/2004/09/30/kimble_rally/ http://www.theregister.co.uk/2004/09/30/kimble_rally/ http://kotaku.com/5878337/arrested-megaupload-boss-cheated-his-way-to-video-game-glory-opponents-say http://kotaku.com/5878337/arrested-megaupload-boss-cheated-h...
halviti 14y ago
I'm very impressed by this. To address some concerns: - Even if this is a PR stunt, it's a very good one, because regardless of the outcome, it convinces many people to sign up. - Many people are claiming that he's not going to pay. Given the fact that this is a PR stunt, it would be twice the failure, and backfire severely if he did not. Honestly, I signed up an account just to poke around, and looking at their offerings, it's quite something. 50GB of space for free! A nice simple and clean interface. The IP addresses of your last connections displayed prominently. Maybe I wouldn't trust it with sensitive documents, but as simple cloud storage, I don't see anyone else offering 50GB of storage for free.
- Trufa 14y ago
  The main reason I don't use is because I don't want to lose my files if it gets seized again that's a pity because it looks and feels great!
benologist 14y ago
1) Use the key passed in the url fragment Doesn't really seem that complicated?
beyti 14y ago
10 grand is a bit cheap when I think of all the advertisement done for mega's security?
visarga 14y ago
Did he pick euro to spite USA?
hawkharris 14y ago
I respect that many people are interested in the ethics of this proposal, but I'm more interested in having a technical discussion about the code, exploring some of its strengths & weaknesses, etc. I'm always impressed with HN's pool of tech knowledge and enjoy learning tech tips from more experienced hackers. (Of course, I suppose there's a good chance these folks are hacking instead of commenting, and maybe they don't want to give away what they've found.)

70 points by skeletonjelly 14y ago

It could be a standing offer with a hole found every other month and they'd be paying far less than the going rate for a quality, full-time security consultant. Better yet, they get to indirectly watch, learn from and adapt to bounty hunters work and only pay out if someone stays fully ahead of them.

eridius 14y ago
This is precisely why this is nothing more than a PR stunt meant to combat the people criticizing Mega's security. Mega is probably secure enough that anyone who is capable of breaking it doesn't need to do so publicly for a 10k Euro bounty, but would either be working for a government, or doing black hat work.
- nikcub 14y ago
  and "they" don't need to break the encryption, they just need to steal a users password
dpeck 14y ago
It doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team. Its one of those things that doesn't scale all that well, one really talented tester can gain a deep understanding of an app and find loads and loads of opportunities for attack. Most bounty bug hunters on the other hand are hard to distinguish from usual internet background noise. Veracode recently put up an infograpic on bounty programs that was kind of interesting, http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-the-internet-safe-infographic/ http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-th...
- incision 14y ago
  >I believe bounty programs are good, but they aren't a replacement for an actual security team. Of course not, I don't mean to suggest that it is. I'm suggesting that this is marketing with potential for cheap labor more than a real commitment to security.

ck2 14y ago

Isn't he a billionaire? Have you see the photos of his home? He might want to make the reward slightly higher than what the black market will pay out.

VonGuard 14y ago
Dunno why you were downvoted. Yer very right. People just don't talk about it this loud.
- corin_ 14y ago
  He was down voted for illogically raising the wealth of Dotcom. By all means argue that it's too low, but the decision for this cost should come from the company's financials and the potential benefits of that spend, not the size of the house its owner lives in.
  - ck2 14y ago
    I mention his wealth because it's specifically from his business and offers a comparison to his ability to pay for security fixes that threaten the very operation of such business. It's like saying hey this business is worth $100k a day to me but I'm only willing to pay $10k to anyone who can show me a problem that would expose all my customers and bring it to a halt, perhaps permanently if the data got into the wrong hands, foreign governments, etc.
    - chaz 14y ago
      A business can't go to the founder as its own piggybank to get out of bad decisions. It's not only a legal and accounting nightmare, but it's bad for the business, too.
      - VonGuard 14y ago
        I didn't really care about who has what money. I just agreed with his point that 10k doesn't beat the black market for something this high profile.

mike_herrera 14y ago

> It's been seven busy days for us since MEGA went live. As millions of users were hitting 50,000 freshly written and barely tested lines of code and dozens of newly installed servers, teething troubles were inevitable. -- Mega blog entry #4 If I were a gambler, my money would be on an infrastructure/man-in-the-middle or social-engineering attack vector. The people are likely stressed and the code is admittedly troublesome. Godspeed.

scottbartell 14y ago
"50,000 freshly written and barely tested lines of code"... it sounds like they're doing it wrong.
- notimetorelax 14y ago
  Considering their success so far I wouldn't be so sure.
- jaggederest 14y ago
  In my opinion, code is never fully tested unless it's produced under extreme clean room conditions (i.e. autopilots, nuclear plant software, space shuttle softwware), or has been used in production for a fair amount of time. Even if your code has full path coverage, you're almost certainly going to interact with an unpredictable outside world that can cause code to fail in novel and interesting ways.
  - DanBC 14y ago
    > Even if your code has full path coverage, you're almost certainly going to interact with an unpredictable outside world that can cause code to fail in novel and interesting ways. Yes. (http://www.f-22raptor.com/news_view.php?nid=267 http://www.f-22raptor.com/news_view.php?nid=267) > Don Shepperd told CNN Television that the onboard navigation, communications and fuel systems crashed as the planes crossed the International Date Line. > The problem seems to have arisen not from the time change, but from the change in longitude from W179.99 degrees to E180 which occurs on the International Date Line. > The USAF refused to specify the cause of the issue saying only that the aircraft "experienced a software problem involving the navigation system en route from Hickam to Kadena". The Wikipedia article List of Software Bugs has some other scary examples of billion dollar systems destroyed, or people killed, by bugs. (http://en.wikipedia.org/wiki/List_of_software_bugs http://en.wikipedia.org/wiki/List_of_software_bugs)

nwh 14y ago

If anything, it'll be an attack against their entropy gathering (mouse movements) or a mis-implemented encryption spec. Given the number of XSS holes in the site, I bet someone will be claiming that bounty soon.

sschueller 14y ago

He should have the reward go up every month it is not claimed.

nu2ycombinator 14y ago

mega-search.me already looks like having problems.

enoch_r 14y ago

Why does Mega's security matter to Mega? It seems like they've implemented encryption to provide plausible deniability that they're knowingly hosting pirated content, not to actually protect the privacy of users, the vast majority of whom will not be uploading confidential data.

DanBC 14y ago
Some pirates are paranoid. That's why Usenet providers[1] started offering encrypted Usenet. [1] EG Giganews, 2006 (http://www.giganews.com/news/article/encrypted-usenet.html http://www.giganews.com/news/article/encrypted-usenet.html)
aw3c2 14y ago
It's cheap advertisements for non-hackers. "It is so secure they een ran a contest to crack it!"

tptacek 14y ago

http://www.schneier.com/crypto-gram-9902.html#snakeoil http://www.schneier.com/crypto-gram-9902.html#snakeoil See: Warning sign #9. Read the whole thing, of course. Holding a contest doesn't make it snake oil...

eps 14y ago
Right. Someone obviously needs to utter "snake oil" when there is a mention of a peer review invitation that involves a bounty.
hayksaakian 14y ago
Because Google chrome is snake oil. Last I heard they still give regular bounties to people who submit major security bugs.
- DanBC 14y ago
  Google offer payments for bugs as a small thank you to people who report bugs. Google accepts that all code has bugs, and they want help to close those bugs. Mega is offering a prize for breaking their crypto. They hope to never pay it out, and they hope to use that as a sales line - "SUPER SECURE CRYPTO NEVER BROKEN!!".
  - nextparadigms 14y ago
    Google also offers "prizes" in the same way at Pwnium.
huhtenberg 14y ago
Your comment makes no sense, of course. You point at a specific item only to say that this item doesn't apply as is. Why pointing at it then? Mega's security effort may very well be disingenuous, but what you wrote comes across as a snobbery.
- jgeralnik 14y ago
  He didn't say the item doesn't apply, he said that it is a warning sign. Holding a contest doesn't make a product snake oil, but it certainly correlates to snake oil products.

ForFreedom 14y ago

only 10K?

Attocs 14y ago

does this have anything to do with me getting a 403 from http://kim.com/mega/ http://kim.com/mega/ ??

jpxxx 14y ago

The hell he'll ever be cutting a check. This is nonsense. And are people seriously using this service? It's like renting a cardboard safe deposit box in a bad neighborhood.

genwin 14y ago
Add TrueCrypt (easy) and it's 50GB of free secure cloud storage.
- jpxxx 14y ago
  ... the use of which drives attention, legitimacy, and revenue to a scumbag.
  - genwin 14y ago
    Make sure to apply the same standards to all the companies and people (including half of Americans) getting away with much worse.
    - jpxxx 14y ago
      It's conceptually easier to go through life avoiding brazen bastards than three quarters of humanity.

chris_wot 14y ago

Look, it's pretty simple. Kim Dotcom is a snake oil salesperson. Great at hype, but ultimately if you dig beneath the covers I suspect there will be nothing there. I should know, I trusted and was very badly burned by someone who spoke big, manipulated others an dultimately had nothing whatsoever other than charm and chutzpah. Give Mega a wide berth, or you too could be badly burned. Someone else has also pointed to the following article about crypto-breaking contests, written by BrucebScneier. Definitely worth a read before getting excited about this contest. http://www.schneier.com/crypto-gram-9812.html#1 http://www.schneier.com/crypto-gram-9812.html#1

ramblerman 14y ago
"I should know, I trusted and was very badly burned by someone who spoke big, manipulated others an dultimately had nothing whatsoever other than charm and chutzpah. Give Mega a wide berth, or you too could be badly burned." Unless that person was Kim Dotcom this is useless diatribe. It is akin to me saying, "I had a bitter divorce so never marry"
- sturgill 14y ago
  For the record, (and as someone who is happily married) I would discourage marrying kids. It's better to wait until both of you are at least 18...

SomeSpectackle 14y ago

Capture the keystrokes & mouse movements used to supplement entropy for the in-the-browser. Recently, the Internet Explorer vulnerability exposed the fact that any webpage can see all mouse movements. MiTM

vincentkriek 14y ago
How would this be a man in the middle attack? You should be able to record it yes but as you said keystrokes & mouse movements are used to SUPPLEMENT entropy, as in they also use other entropy.
- nwh 14y ago
  They aren't using anything but that and `rand()`. They could use the Crypto library in Webkit, but they're not.
pfortuny 14y ago
Ok, just do it.

kayoone 14y ago

Kim Schmitz is known for screwing people alot of Times, so if you try your luck with this keep that in mind. Endeavors where he took others peoples Money in Return for nothing or didnt Pay Prize money: Ultimate Rally Kimvestor (letsbuyit.com) Osama bin Laden bounty Trendax AI trading company Liga.net Gaming League (around 1999)

Dylan16807 14y ago
Let's see. Ultimate Rally - never got past the planning stage, who did he take money from? letsbuyit.com - He said he was going to invest and then didn't. He never promised money to the people that lost it here, they were just speculators. Yes it was illegal, but he didn't breach any agreements. (Actually might not have been illegal at the time) bin Laden bounty - nobody gave him information leading to finding bin laden so there is no bounty, I don't see the problem here Trendax - well that's clearly a scam but I can't find if people actually invested there Liga.net - please tell me I missed something and you didn't put this on the list for cheating in a video game
- kayoone 14y ago
  I just wanted to point out that he is/was a shady person and people should be cautious dealing with him. To adress your points: Ultimate Rally - afaik there where some poeple on forums that paid a significant entry fee and didnt get it back letsbuyit.com - clearly illegal, insider trading and he got a prison sentence + 100k fine Bin Laden bounty - true, but it still was smelly Liga.net - it was a Quake2 Duel League back in 98/99 (if i remember correctly). Kimble was known for playing lots of Quake back in the day, he invited the most promiment players, first prize was some super High end PC (of the time) and money but the winner never got it and was kicked out of the league, which was shutdown soon after that : http://planetquake.gamespy.com/fullstory.php?id=61507 http://planetquake.gamespy.com/fullstory.php?id=61507 Its just a fact that you should not trust this guy given his history. Sure people change, but be cautios! more info: http://www.theregister.co.uk/2004/09/30/kimble_rally/ http://www.theregister.co.uk/2004/09/30/kimble_rally/ http://kotaku.com/5878337/arrested-megaupload-boss-cheated-his-way-to-video-game-glory-opponents-say http://kotaku.com/5878337/arrested-megaupload-boss-cheated-h...

halviti 14y ago

I'm very impressed by this. To address some concerns: - Even if this is a PR stunt, it's a very good one, because regardless of the outcome, it convinces many people to sign up. - Many people are claiming that he's not going to pay. Given the fact that this is a PR stunt, it would be twice the failure, and backfire severely if he did not. Honestly, I signed up an account just to poke around, and looking at their offerings, it's quite something. 50GB of space for free! A nice simple and clean interface. The IP addresses of your last connections displayed prominently. Maybe I wouldn't trust it with sensitive documents, but as simple cloud storage, I don't see anyone else offering 50GB of storage for free.

Trufa 14y ago
The main reason I don't use is because I don't want to lose my files if it gets seized again that's a pity because it looks and feels great!

benologist 14y ago

1) Use the key passed in the url fragment Doesn't really seem that complicated?

beyti 14y ago

10 grand is a bit cheap when I think of all the advertisement done for mega's security?

visarga 14y ago

Did he pick euro to spite USA?

hawkharris 14y ago

I respect that many people are interested in the ethics of this proposal, but I'm more interested in having a technical discussion about the code, exploring some of its strengths & weaknesses, etc. I'm always impressed with HN's pool of tech knowledge and enjoy learning tech tips from more experienced hackers. (Of course, I suppose there's a good chance these folks are hacking instead of commenting, and maybe they don't want to give away what they've found.)