• ETH Zurich discovered major vulnerabilities in encrypted cloud storage.
• Flaws found may enable data breaches and tampering.

A recent study by ETH Zurich has uncovered major cryptographic vulnerabilities in several well-known end-to-end encrypted (E2EE) cloud storage services.

The vulnerabilities could allow attackers to compromise file confidentiality, tamper with data, or inject unauthorised files into users’ storage, undermining the very security that E2EE promises.

Popular E2EE services under review

The research focused on five E2EE services: Sync, pCloud, Seafile, Icedrive, and Tresorit. Together, these services serve an estimated 22 million users worldwide, and each is touted as offering E2EE, which should theoretically prevent anyone other than the uploader from accessing or changing stored files. This security measure is intended to prevent even cloud providers from accessing data, thereby safeguarding its privacy.

Despite these assurances, ETH Zurich researchers Jonas Hofmann and Kien Tuong Truong revealed substantial vulnerabilities in four of the five services studied that could allow a determined attacker to bypass E2EE’s protections. The findings, presented at the ACM Conference on Computer and Communications Security (CCS), indicate a serious gap in the security of encrypted cloud storage.

Who stood out? The service with the fewest vulnerabilities

Of the five services examined, Tresorit was found to have the fewest vulnerabilities. However, the company’s offering was not flawless, as researchers discovered some potential for metadata tampering and the use of non-authentic keys for file sharing. Though only minor, these issues could pose dangers in some instances.

However, the other four services had far more significant security vulnerabilities, putting customer data at higher risk of exposure or tampering.

Ten attack scenarios simulated: Realistic threats to E2EE

The researchers tested ten different types of potential exploits across the E2EE services, all requiring the attacker to control a cloud server and have the ability to read, modify, or inject data. While this level of access might seem unlikely, the researchers contend that it is a significant threat to E2EE systems, as services should ideally secure files even if the server is compromised.

Some of the more concerning vulnerabilities were:

• Unauthenticated key material: Both Sync and pCloud were liable due to unauthenticated encryption keys, which allowed attackers to insert their own keys, decrypt stored files, and get access to sensitive data.
• Public key substitution: Sync and Tresorit showed weaknesses with unauthenticated public keys, potentially enabling attackers to replace legitimate keys with their own during file sharing, thus intercepting or altering files.
• Protocol downgrade attack: Seafile’s service allowed for the encryption process to be downgraded to a weaker form with fewer iterations in the Key Derivation Function (KDF), increasing vulnerability to brute-force attacks.
• Decryption key exposure: Sync also had a flaw where decryption passwords were exposed through shared file links, posing a significant risk to data confidentiality.

Tampering and file injection: Potential risks to file integrity

Beyond the initial vulnerabilities, the study identified other flaws that could enable attackers to interfere with files in storage. For example, Icedrive and Seafile were found to use unauthenticated encryption modes, which could allow attackers to alter ciphertext and corrupt file contents. Additionally, the process of “chunking”—where files are divided into pieces for storage—was found to be unauthenticated in pCloud, Icedrive, and Seafile. This flaw could allow an attacker to reorder, remove, or modify file chunks, compromising file integrity and potentially making files unreadable.

Other tampering risks identified include:

• File and folder injection: pCloud permitted file injection, while Sync, Icedrive, and Seafile exhibited flaws where in specific scenarios, attackers would be able to inject files or even entire folders into users’ storage.
• File and metadata tampering: With the exception of Tresorit, all tested services were found to enable file-name tampering. Additionally, metadata tampering was possible in all five services, opening up opportunities for attackers to disrupt data organisation and visibility.

The researchers noted that problems are not limited to one or two services, but are widespread throughout the E2EE cloud storage industry, indicating a systemic problem. With similar vulnerabilities occurring across many platforms, the researchers proposed that the cloud storage sector might benefit from a standardised set of protocols to ensure truly secure E2EE.

The authors urged for more analysis of E2EE cloud services to improve understanding of the vulnerabilities that affect real-world systems. More industry-wide assessments could help foster solutions to close these gaps.

Responses from the affected providers

ETH Zurich disclosed their findings to Sync, pCloud, Seafile, and Icedrive on April 23, 2024, while Tresorit was informed on September 27, 2024. By the time the paper was published, responses varied among the providers. Sync and pCloud had yet to respond, while Seafile mentioned plans to patch the protocol downgrade flaw, and Icedrive declined to address the issues raised. Tresorit acknowledged receipt of the disclosure but did not comment further.

According to a recent report by BleepingComputer, Sync has since stated that it is “fast-tracking fixes” for the reported vulnerabilities and confirmed it has already resolved data leaks related to sharing links.

Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. Explore other upcoming enterprise technology events and webinars powered by TechForge here.