Nas til Firma

13. SUMMARY OF FINDINGS

In the past sections, we found the following weaknesses:

CloudMe is open for a wide range of attacks, including username enumeration,

sending unwanted emails, Cross-Side Request Forgery attacks, account

hijacking and incrimination attacks.

CrashPlan uses a self-made, unpublished protocol for transport security, although

SSL/TLS is an established alternative. It is not possible to remove

individual installations.

Dropbox does not verify the email address at registration, hence it is open for

incrimination attacks. Client-side encryption is not supported. It is

unclear which flavor of sharing is used if non-subscribers are included

(closed user group vs. publication).

Mozy encrypts files, but not filenames. The service does not manage crossuser

deduplication in a secure way, thus enabling users to check if

some file is already on Mozy's server. Weak passwords are accepted

without notice.

TeamDrive uses a self-made, unpublished protocol for transport security, although

SSL/TLS is an established alternative. It is not possible to remove

devices again after they have been activated. When participants are

removed from spaces, the cryptographic key used to encrypt the space

is not changed. We also noticed that the password reset was using http

transmission without any encryption, this has been fixed by Team-

Drive after we notied them.

Ubuntu One does not provide any encryption.

Wuala does not verify the email address at registration, hence it is open for

incrimination attacks. The service uses a self-made unpublished protocol,

although SSL/TLS is an established alternative. The encryption

scheme does not protect against attackers that have access to the unencrypted 

files. URLs shared with non-subscribers contain the user

name.