On the Security of Cloud Storage Services
Total Page：16
File Type：pdf, Size：1020Kb
FRAUNHOFER INSTITUTE FOR SECURE INFORMATION TECHNOLOGY SIT TECHNICAL REPORTS ON THE SECURITY OF CLOUD STORAGE SERVICES 03/2012 FRAUNHOFER VERLAG On the Security of Cloud Storage Services Moritz Borgmann, Tobias Hahn, Michael Herfert, Thomas Kunz, Marcel Richter, Ursula Viebeg, Sven Vowe´ Ed. Michael Waidner SIT Technical Reports SIT-TR-2012-001 March 2012 Fraunhofer Institute for Secure Information Technology SIT Rheinstraße 75 64295 Darmstadt Germany IMPRINT Contact Fraunhofer Institute for Secure Information Technology SIT Rheinstraße 75 64295 Darmstadt Germany Phone +49 (0) 6151 869-213 Fax +49 (0) 6151 869-224 E-Mail [email protected] URL www.sit.fraunhofer.de Ed. Michael Waidner SIT Technical Reports SIT-TR-2012-001: On the Security of Cloud Storage Services Moritz Borgmann, Tobias Hahn, Michael Herfert, Thomas Kunz, Marcel Richter, Ursula Viebeg, Sven Vowe´ ISBN 978-3-8396-0391-8 ISSN 2192-8169 Printing: Mediendienstleistungen des Fraunhofer-Informationszentrum Raum und Bau IRB, Stuttgart Printed on acid-free and chlorine-free bleached paper. All rights reserved; no part of this publication may be translated, reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the written permission of the publisher. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. The quotation of those designations in whatever way does not imply the conclusion that the use of those designations is legal without the consent of the owner of the trademark. On the Security of Cloud Storage Services · 4 © by FRAUNHOFER VERLAG, 2012 Fraunhofer Information-Centre for Regional Planning and Building Construction IRB P.O. Box 80 04 69, D-70504 Stuttgart Nobelstrasse 12, D-70569 Stuttgart Phone +49 (0) 7 11/9 70-25 00 Fax +49 (0) 7 11/9 70-25 08 E-Mail [email protected] URL http://verlag.fraunhofer.de On the Security of Cloud Storage Services · 5 CONTENTS Executive Summary 10 1 Introduction 13 1.1 Scope........................................ 14 1.2 Definition of Cloud Storage Services........................ 15 1.3 Use Cases for Cloud Storage Services....................... 16 Part I: Principles of Cloud Storage Services 18 2 The User’s View 19 2.1 Features....................................... 19 2.1.1 Copy.................................... 19 2.1.2 Backup................................... 20 2.1.3 Synchronization.............................. 20 2.1.4 Sharing................................... 21 2.2 Interfaces...................................... 21 2.2.1 Proprietary Software Clients........................ 21 2.2.2 Browser Interface.............................. 21 2.2.3 Application Programming Interface.................... 21 2.3 Optimization.................................... 22 2.3.1 Deduplication................................ 22 2.3.2 Delta Encoding............................... 23 2.3.3 Compression................................ 23 3 The Lawyer’s View 24 3.1 Legal Regulations in Germany........................... 24 3.1.1 Data Protection............................... 24 3.1.2 Further Legal Provisions.......................... 26 3.1.3 Certification and Guidelines........................ 28 3.2 Legal Regulations in the EU............................ 31 3.2.1 The Data Protection Directive....................... 31 3.2.2 The Safe Harbor Framework........................ 32 3.2.3 Recommendations............................. 33 On the Security of Cloud Storage Services · 6 3.3 Legal Regulations in the USA........................... 34 3.3.1 The Patriot Act............................... 34 3.3.2 The Fourth Amendment.......................... 34 4 The Security Engineer’s View 36 4.1 Registration and Login............................... 36 4.2 Transport Security.................................. 38 4.3 Encryption...................................... 39 4.4 File Sharing..................................... 40 4.5 Deduplication.................................... 41 4.6 Multiple Devices.................................. 43 4.7 Update Functionality................................ 44 4.8 Server Location................................... 44 4.9 Classification of Security Requirements...................... 44 4.10 Further Threats................................... 47 4.10.1 Time Related Aspects........................... 47 4.10.2 Advanced Persistent Threats........................ 48 4.10.3 A Note on Client-side Encryption..................... 49 Part II: Analysis of Cloud Storage Services 51 5 Methodology for Analysis 52 5.1 Selection of Products................................ 52 5.2 Scope........................................ 53 5.3 Format........................................ 54 6 CloudMe 56 6.1 Synopsis....................................... 56 6.2 Availability..................................... 56 6.3 Features....................................... 57 6.4 Security....................................... 60 7 CrashPlan 64 7.1 Synopsis....................................... 64 7.2 Availability..................................... 64 7.3 Features....................................... 66 On the Security of Cloud Storage Services · 7 7.4 Security....................................... 67 8 Dropbox 72 8.1 Synopsis....................................... 72 8.2 Availability..................................... 72 8.3 Features....................................... 72 8.4 Security....................................... 74 9 Mozy 79 9.1 Synopsis....................................... 79 9.2 Availability..................................... 79 9.3 Features....................................... 80 9.4 Security....................................... 81 10 TeamDrive 86 10.1 Synopsis....................................... 86 10.2 Availability..................................... 86 10.3 Features....................................... 88 10.4 Security....................................... 90 11 Ubuntu One 94 11.1 Synopsis....................................... 94 11.2 Availability..................................... 94 11.3 Features....................................... 97 11.4 Security....................................... 99 12 Wuala 103 12.1 Synopsis....................................... 103 12.2 Availability..................................... 103 12.3 Features....................................... 104 12.4 Security....................................... 109 13 Summary of Findings 114 Part III: Recommendations and Conclusion 115 14 Local Encryption Methods 116 On the Security of Cloud Storage Services · 8 14.1 Approaches enhancing security........................... 116 14.2 Approaches not enhancing security......................... 119 15 Selecting a Cloud Storage Service 121 16 Conclusion 124 Glossary 127 Acknowledgements 128 References 129 A Attack on CloudMe Desktop 132 B Incrimination attack on CloudMe, Dropbox and Wuala 133 On the Security of Cloud Storage Services Moritz Borgmann, Tobias Hahn, Michael Herfert, Thomas Kunz, Marcel Richter, Ursula Viebeg, Sven Vowe´ Fraunhofer-Institute for Secure Information Technology SIT, Darmstadt Key Words: Cloud Computing, Cloud Storage, Security, Privacy, Encryption, Confidentiality, Outsourcing This work was partly funded by CASED (www.cased.de). SIT Technical Reports SIT-TR-2012-001 On the Security of Cloud Storage Services · 10 Executive Summary The ever-increasing amount of valuable digital data both at home and in business needs to be pro- tected, since its irrevocable loss is unacceptable. Cloud storage services promise to be a solution for this problem. In recent years, their popularity has increased dramatically. They offer user- friendly, easily accessible and cost-saving ways to store and automatically back up arbitrary data, as well as data sharing between users and synchronization of multiple devices. However, individuals and especially businesses hesitate to entrust their data to cloud storage services since they fear that they will lose control over it. Recent successful attacks on cloud stor- age providers have exacerbated these concerns. The providers are trying to alleviate the situation and have taken measures to keep their customers’ data secure. In this study we have examined the security mechanisms of seven cloud storage services: CloudMe, CrashPlan, Dropbox, Mozy, TeamDrive, Ubuntu One, Wuala. The study may be useful for users of the examined services, but also for users of other services by checking if these services match the identified security requirements. Approach Each service includes a piece of client software and a server-side software. We examined the client software for PCs, never made a penetration test on the server-side. The obser- vation period started in summer 2011 and ended in January 2012. In a first step, we identified four typi- cal features of cloud storage services. (i) Copy Backup Sync. Sharing The copy feature. This means a service CloudMe 33 just mirrors a part of the local disk in the cloud. If local hardware drops out (e.g. a CrashPlan 3 stolen laptop) data can be recovered from Dropbox 333 the cloud. (ii) The backup feature which Mozy 3 is used to preserve any version of a file in the cloud. (iii) The synchronization TeamDrive 3333 feature which enables a user to synchro- Ubuntu One 333 nize all of his devices (desktop, laptop, Wuala 3333 tablet, mobile phone). (iv) The file shar- ing feature which is used for collabora- Table I. Features of cloud storage services. tion with