Mega says bug bounty program led to fixing of seven flaws
Crypographic challenges unsolved, no critical remote code execution flaw reported so far, Mega's creators say
IDG News Service - One week after launching a security bug bounty program, the new file-storage and sharing service Mega claims to have fixed seven vulnerabilities, none of which met its highest severity classification.
Since Mega was launched three weeks ago, security researchers pinpointed several security issues with the service, ranging from simple cross-site scripting flaws to alleged weaknesses in its cryptographic model.
Mega's creators dismissed some of the issues as theoretical and asked for practical exploits. To support such efforts, a week ago they launched a vulnerability reward program similar to those run by companies such as Google, Facebook, Mozilla and PayPal, as well as two crypto cracking challenges to prove that their cryptographic implementation is solid.
The company promised rewards of up to A!10,000 for responsibly reported vulnerabilities that meet the program's qualification requirements. In a new blog post published Saturday, the company said that reported vulnerabilities will be ranked according to severity, with "class I" being the least severe and "class VI" being the most severe.
So far, seven vulnerabilities have been reported and fixed, according to the blog post.
Of those, the most severe vulnerability was an "invalid application of CBC-MAC as a secure hash to integrity-check active content loaded from the distributed static content cluster." This vulnerability was rated class IV, which is assigned to "cryptographic design flaws that can be exploited only after compromising server infrastructure (live or post-mortem)."
Shortly after fail0verflow's report, security researchers from antivirus firm Sophos reported that Mega dropped CBC-MAC in favor of SHA-256, a proper hashing function. In its new blog post Mega notes that that flaw was fixed within hours.
In addition to this vulnerability, Mega's creators claim that three cross-site scripting (XSS) vulnerabilities with a class III severity rating were addressed. Class III flaws are described as vulnerabilities that can be generally exploited to achieve remote code execution inside client browsers (cross-site scripting).
Mega did not publish the names of the researchers who discovered these flaws -- a somewhat unusual practice when compared to other bug bounty programs -- or how much money it paid for each one.
Based on discussions on Twitter, it seems that one of these three XSS vulnerabilities was reported by a security researcher named Frans Rosen. Rosen posted a screen shot of what appears to be his email communication with Mega, suggesting that he received a reward of A!1,000 for his report.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Future Focus: What's Coming in Enterprise Mobility Management (EMM) Find out why Enterprise Mobility Management (EMM) solutions that are truly future-ready must be designed to enable Machine-to-Machine (M2M) capabilities and much more.
- The CIO's Guide to Enterprise Mobility Management (EMM) This guide will help those making an EMM platform decision make the best choice for their organization.
- Yankee Group: BlackBerry Results Refute Rumors of its Demise Yankee Group: BlackBerry® is stronger than the press makes it out to be.
- Your New EMM Platform: How to Streamline the Migration Smartphone migration can be resource-intensive and challenging. Find out how outsourcing the process can save significant time and money.
- Live Webcast Increasing the Value of Your Reports and Dashboards Learn how incorporating other analytical capabilities such as predictive modeling and visualization can increase the value of your reports and dashboards by providing...
- Testimonial: Cystic Fibrosis Trust Peter Hawkins, the Head of IT for Cystic Fibrosis Trust, discusses the role CommVault's Simpana software platform plays in improving the company's information...
- Increasing the Value of Your Reports and Dashboards Learn how incorporating other analytical capabilities such as predictive modeling and visualization can increase the value of your reports and dashboards by providing... All Management White Papers | Webcasts