Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwncloud – Bad crypto in the Owncloud encryption module

blog.hboeck.de

Post reply on HN
Print view View original

41–46 of 46 posts

Re: Pwncloud – Bad crypto in the Owncloud encryption module

#41

Post by JohnIcare »

embik wrote: post #37
Semaphor wrote: post #33

Earlier quoted context omitted.

What seems truly scary is how little the developer seemed to care about those security bugs (following related issues, you also find an exploit, SQL injection and so on) and being dismissive of the guy who found them.

https://github.com/haiwen/seafile/issues/587#issuecomment-40... > We don't roll our own crypto. > There are two parts of the code base in which "we roll our own crypto": the transfer protocl and encrypted library. That's just ridiculous.

For information : since that github comment, now the protocol relies only on HTTPS.

About metadata : https://seacloud.cc/group/3/wiki/seafile-roadmap.md there is one line saying "Ability to encrypt all data by server key. Key has to be generated by administrator" but it's not on the changelog page ( https://seacloud.cc/group/3/wiki/Server%20ChangeLog.md )

Re: Pwncloud – Bad crypto in the Owncloud encryption module

#42

Post by Tepix »

microtonal wrote: post #27
schlowmo wrote: post #2

> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space." While it's a good finding that even in this specifi…

Bittorrent Sync does end to end encryption, and you can set up an encrypted read-only peer that never sees any plain text. The encrypted peer does contribute to the swarm.

It's closed source.

Re: Pwncloud – Bad crypto in the Owncloud encryption module

#43

Post by microtonal »

Tepix wrote: post #42
microtonal wrote: post #27

Earlier quoted context omitted.

Bittorrent Sync does end to end encryption, and you can set up an encrypted read-only peer that never sees any plain text. The encrypted peer does contribute to the swarm.

It's closed source.

Sadly, yes. So if anyone is looking for a nice disruptive open source project ;).

(No, SyncThing, despite its greatness is not it. The sharing model is too complex for the average user.)

Re: Pwncloud – Bad crypto in the Owncloud encryption module

#44

Post by gpvos »

gpvos wrote: post #31

They mention that Windows will still execute the DOS stub when it can't find a PE header. Is this still true in 64-bit Windows? I would think that the DOS stub would be 16-bit code, which is not supported anymore in 64-bit Windows.

Indeed it isn't, at least according to Wikipedia: https://en.wikipedia.org/wiki/DOS_MZ_executable#Compatibilit... says: 64-bit versions of Windows cannot execute them.

Re: Pwncloud – Bad crypto in the Owncloud encryption module

#45

Post by xjqkilling »

dchest wrote: post #26
JohnIcare wrote: post #25

Earlier quoted context omitted.

There is seafile ( https://www.seafile.com/en/home/ ) which provides client side encryption. Easy to install and to upgrade (except a small glitch in the last upgrade). For the community version, the source code is here : https://github.com/haiwen/seafile (see others haiwen projects). The Android client could be improved, but it does the job.

This issue in Seafile was lovely: https://github.com/haiwen/ccnet/issues/35 /* truly random sequece read from /dev/urandom. */ static unsigned char salt[8] = { 0xdb, 0x91, 0x45, 0xc3, 0x06, 0xc7, 0xcc, 0x26 }; https://github.com/haiwen/seafile/issues/587 Enough to understand if people writing this software know how to apply cryptography. This was 2 years ago, so I hope they improved.

This was 2 years ago. The situation is much better now. You can find how Seafile handles user passwords at http://manual.seafile.com/security/security_features.html

Re: Pwncloud – Bad crypto in the Owncloud encryption module

#46

Post by jospoortvliet »

starts wrote: post #15

That's quite worrisome..

Ach, look at it this way. If it was in a proprietary product, you could sleep safely because nobody would ever tell you that your data was insecure. ;-)

We pay researchers and others to check ownCloud for security issues (the writer of this post got paid by us), we have security checks done by various companies etcetera - see https://owncloud.org/blog/hackerone-case-study-on-owncloud/

But it is, of course, still insecure because nothing is secure. I only can say we're pretty much the project with the best security processes and most attention towards security in the file sync and share space. From the open source ones, at least - you'll never know about the closed ones, they keep things hush-hush. Protecting your sleep (not your data).

Post reply on HN