On the Security of Cloud Storage Services

FRAUNHOFER INSTITUTE FOR SECURE INFORMATION TECHNOLOGY ON THE SECURITY OF CLOUD Sharing of data was a problem for CloudMe, Dropbox, Team- Summary Individuals or companies considering to use cloud STORAGE SERVICES Drive and Wuala. Problems occur if fi les are shared with non- storage services are advised to check whether a cloud provider MANAGEMENT SUMMARY subscribers by a long, unpredictable URL. CloudMe does not meets these security requirements. obfuscate this URL adequately. Dropbox gives an unclear de- scription wrt to sharing details, TeamDrive is weak when disin- In addition, it is worthwhile to consider using more than one viting a group member and Wuala enables information gathe- service to reduce the impacts of service downtime. Further, ring by including the user name in public URLs. CloudMe does calculation of the time to recover all data from the cloud is re- not prevent search engines from accessing the workspace. commended. Depending on the individual amount of data, this may take several days. Having a plan for a provider Deduplication was a problem for Mozy and Wuala, because change in the future reduces the dependancy on a particular in some cases it is possible to ask the cloud storage provider provider (provider lock-in). This will be relevant, for example, if whether a fi le is already stored or not. the chosen provider is getting too expensive or is not longer compliant with governmental rules. As a major result, the stu- Data confi dentiality can be improved by users by encrypting dy shows that most of the analyzed cloud storage providers their data locally before uploading it to the cloud. This can be are aware of the extreme importance of data security and pri- done using a variety of available encryption tools, including vacy, hence they have taken protection measures. However, a TrueCrypt, EncFS and GnuPrivacyGuard. Under some circum- solution which meets all of the mandatory security require- stances these tools will interfere with features of the storage ments has not been found with any of the analyzed providers. service. Users should be conscious that in any case they trust the provider by using client software supplied by the provider. Free Download The complete study may be downloaded under Legal Considerations In addition, we considered legal requi- http://sit4.me/cloudstudy2012 rements for a compliant usage of cloud storage services. An examination of laws and legal provisions shows that the cloud user is primarily responsible for his data and its processing. Es- Contact pecially companies have to consider that the legal requirements to which they must adhere may differ to those for the Michael Herfert cloud provider or a potential subcontractor. The absence of in- Phone +49 6151 869-329 ternational regulations guaranteeing an adequate level of data Fax +49 6151 869-322 security and privacy requires that European companies must [email protected] choose cloud providers based within the European Economic Area (EEA). Additionally, these providers should not be subsidi- Fraunhofer Institute for Secure Information Technology aries of companies based in the United States, otherwise the Rheinstrasse 75 Patriot Act can be used to gain access to the data stored at 64295 Darmstadt, Germany the provider, even if it is exclusively stored within the EEA. www.sit.fraunhofer.de ON THE SECURITY OF CLOUD STORAGE SERVICES The ever-increasing amount of valuable digital data both at In this study we have examined the security mechanisms of se- Secure file sharing, to protect documents shared by a closed the computers of other users. Both attacks require a certain home and in business needs to be protected, since its irrevo- ven cloud storage services: CloudMe, CrashPlan, Dropbox, group, optionally including non-subscribers. (v) Secure dedup- kind of inattention on the victim‘s side, nevertheless this secu- cable loss is unacceptable. Cloud storage services promise to Mozy, TeamDrive, Ubuntu One, Wuala. lication, to avoid privacy problems when using deduplication. rity gap should be closed. be a solution for this problem. In recent years, their popularity has increased dramatically. They offer user-friendly, easily ac- The study may be useful for users of the examined services, Results We have applied the security requirements to the se- Transport Security was a problem for CrashPlan, TeamDrive cessible and costsaving ways to store and automatically back but also for users of other services by checking if these services lected services, as shown in table II. and Wuala because they deny the usage of SSL/TLS. Instead up arbitrary data, as well as data sharing between users and match the identified security requirements. they use unpublished, self-made protocols – a very error-prone synchronization of multiple devices. However, individuals and Registration was a problem for CloudMe, Dropbox and Wua- approach. CloudMe does not take any measure to protect the especially businesses hesitate to entrust their data to cloud Approach Each service includes a piece of client software la because they missed to verify the email address of a new security of files during transmission. storage services since they fear that they will lose control over and a server-side software. We examined the client software customer. Hence, an impersonation attack is possible, that it. Recent successful attacks on cloud storage providers have for PCs, but never made a penetration test on the server-side. means a person A can register with the email address of ano- Encryption was a problem for CloudMe, Dropbox and exacerbated these concerns. The providers are trying to allevi- The observation period started in summer 2011 and ended in ther person B. After that several attacks are possible: If A is a Ubuntu One because they do not use client-side encrypti- ate the situation and have taken measures to keep their cus- January 2012. Dropbox or Wuala user there is a chance to spy out data from on, thus the provider is able to read the data. The conver- tomers‘ data secure. other users, most likely the friends of B. If A is a user of Cloud- gent encryption scheme used by Wuala enables attacks by In a first step, we identified four typical features of cloud sto- Me, Dropbox or Wuala there is a chance to inject malware in a server-side attacker. rage services. (i) The copy feature. This means a service just mirrors a part of the local disk in the cloud. If local hardware drops out (e.g. a stolen laptop) data can be recovered from the cloud. (ii) The backup feature which is used to preserve Table I. Features of cloud storage services Table II. Grades any version of a file in the cloud. (iii) The synchronization feature which enables a user to synchronize all of his devices Copy Backup Sync. Sharing Registration Transport Encryption Sharing Deduplication (desktop, laptop, tablet, mobile phone). (iv) The file sharing CloudMe feature which is used for collaboration with project partners. CloudMe – – – – – – – x In addition, we have identified optimization features like dedu- CrashPlan CrashPlan + + – + x + plication (files that are known by the server are not transferred Dropbox again) which may be supported by the service. Each service Dropbox – + – + – + supports one or more of the features above as shown in table I. Mozy Mozy + – + + – x – ++ very good + good TeamDrive Second, we identified security requirements. The top five re- TeamDrive + – + – + + – x + – some quirements and their objectives are: (i) Registration and login, Ubuntu One Ubuntu One ++ + – – ++ + weaknesses to protect against impersonation, and information gathering – bad and to enforce usage of strong passwords. (ii) Transport secu- Wuala Wuala – + – + – + – – – – very bad rity, to secure communication between client and server. (iii) x not available Encryption, to disable the provider to examine stored data. (iv) .

Load more