USENIX Security ’11: Dark Clouds on the Horizon

In August we will present our work on cloud storage security at the 20th USENIX Security Symposium in San Francisco. The paper, in essence, outlines new attacks on cloud storage services that use server-side data deduplication.

It includes a security analysis of Dropbox, a popular cloud storage service. By manipulating the client software unauthorized data access becomes possible, if the hash values of the files are known to an attacker. This attack is completely undetectable to the victim, and novel compared to recent attacks discussed in the media. Data possession proofs which have been used so far in the context of assessing whether a cloud storage operator is still in possession of a file are the only countermeasure.

We further define online slack space as a method to hide data in the cloud to thwart forensic investigations. Compared to regular file slack all files are stored in the cloud without leaving any evidence on local persistent storage.

You can find the paper here: Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space. We have contacted Dropbox and they implemented countermeasures for our attacks while investigating the use of data possession proofs on the client side.

Stefan Katzenbeisser on ZDF (German TV)

Stefan Katzenbeisser talks about privacy and mobile security (starting at 14:43)

SBA master student discovers flaw in Ruby on Rails

Rails 3.0.5 doesn’t validate the input for the X-Forwarded-For field in the header sent by clients with a class C remote-addr. (see: TRUSTED_PROXIES). (Security Focus, more details…)