Pwncloud – Bad crypto in the Owncloud encryption module
blog.hboeck.de
Pwncloud – Bad crypto in the Owncloud encryption module
1–10 of 46 posts
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#2> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space."
While it's a good finding that even in this specific scenario the crypto-module is screwed up, I think an even bigger problem is that most people hosting owncloud either don't know or care about all threats not covered by this scenario.
I heard stuff like "Owncloud has crypto, so it must be secure." from people hosting owncloud on server they didn't have much control (especially physically) about. It's not only the "malicious server operator" but everyone with administrative access (legitimate or not) to this server.
But unfortunately I don't know a selfhosted easy-to-install-and-use alternative with strong client-side encryption, which boils down to: Dropbox (or any other cloud storage provider) with client-side encryption of your own choice is more secure than owncloud with only the crypto-module.
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#3> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space." While it's a good finding that even in this specifi…
I just want to add a big emphasis to "YOUR OWN CRYPTO" with Dropbox. Stuffing data into Dropbox without encrypting it first for example with VeraCrypt is a bad choice. Even Dropbox says their own employees "need" access to your data "occasionally". (Also, I meant to upvote you but I fat-fingered it on my phone, sorry!)
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#4This is a really great writeup. But CTR+HMAC is, in fact, a composed authenticated encryption mode. If you have a working system with CTR+HMAC, I'd recommend against spending effort switching to GCM, which is actually harder to get right.
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#5Still recall running across a vendor that was hashing credit cards using MD5. Asked them why, and their response was that they were PCI compliant. Called the main PCI line, asked them if MD5 hash was an acceptable way to store credit cards securely, and the answer was yes.
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#6So what is the implication of this? The major reason to use the crypto module is that my users can add their google drives to owncloud and its encrypted on there.
Whats the recommended course of action?
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#7> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space." While it's a good finding that even in this specifi…
For those who aren't afraid of manual control (which can be a pro or con) and a bit cryptic CLI invocations, I'd say - give git-annex a try.
It works with multiple remotes (hubiC, OneDrive and SFTP) flawlessly for me.
A basic file management is well automated by git-annex-assistant (e.g. just moving a file to "archive" directory makes sure necessary number of remotes have a copy and a local one is then removed, etc etc.), but the initial setup has to be done by a tech-savvy person who had spent some time reading the docs.
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#8> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space." While it's a good finding that even in this specifi…
I just want to add a big emphasis to "YOUR OWN CRYPTO" with Dropbox. Stuffing data into Dropbox without encrypting it first for example with VeraCrypt is a bad choice. Even Dropbox says their own employees "need" access to your data "occasionally". (Also, I meant to upvote you but I fat-fingered it on my phone, sorry!)
VeraCrypt or other FDE-like tools (that are meant to be used on actual drives or their imitations using a file-backed device) are not so great idea for use with Dropbox or alike file/object storages. Here's why: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#9> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space." While it's a good finding that even in this specifi…
I just want to add a big emphasis to "YOUR OWN CRYPTO" with Dropbox. Stuffing data into Dropbox without encrypting it first for example with VeraCrypt is a bad choice. Even Dropbox says their own employees "need" access to your data "occasionally". (Also, I meant to upvote you but I fat-fingered it on my phone, sorry!)
Yes, maybe I should've made this emphasis stronger in my comment. Also I didn't meant to say that using owncloud is worse than using dropbox in security terms - but you should use your own (client-side) crypto either way if you care about data security.
For myself I use my selfhosted owncloud (running on a cheap VPS) with EncFS, encourage other users on that server to use client-side encryption as well and never lied about how secure their data is when they decide not to. But this isn't so easy as it should be.
Re: Pwncloud – Bad crypto in the Owncloud encryption module
#10So what is the implication of this? The major reason to use the crypto module is that my users can add their google drives to owncloud and its encrypted on there. Whats the recommended course of action?
If you want to go along with owncloud (and I don't know a proper alternative) there's not much you can do then upgrading to Owncloud 9 and hope that the fix was done right. In the meantime you could encourage your users to use their own client-side encryption while giving up the idea of an easy setup.