Mega Weaknesses Found In MEGA Cloud Storage System

Yet another example of just how unsafe cloud storage can be.

These days, cloud computing has us all retooling our due diligence processes. Here’s an example of why!

A security researcher has found that confirmation emails sent by MEGA to new users put users’ passwords at risk for being cracked by hackers. A program called MegaCracker has recently been released by the very researcher who discovered the vulnerability which can take the link given in one of these confirmation emails and extract the user’s password. It is well known that attackers have no problem intercepting unencrypted email messages, so the fact that MEGA is sending passwords as hashes over email has many security professionals scratching their heads.

MEGA has only so far responded by defending its methods and claiming that as long as users use strong passwords, there is no risk. However, security researches maintain that it is unconventional to send both the hashed password and the master encryption key in a confirmation email. Many other companies, such as Netflix and Twitter, option for sending new users a random number value which is only known by the server and recipient. In the hours following the announcement of the program and the vulnerability, articles from Forbes and IDG News have cautioned their readers to avoid placing confidential information on the company’s cloud servers.

Original article by Dan Goodin.
Read the full story here.

Related Posts

Considerations – Why you should choose infotex, Inc. as your next MSOC!

Reasons why we should be considered! infotex provides a number of services that can be checked out if you click over to! We even made a movie with all the reasons why infotex...

The Magnificent Seven 2023

Seven Trends . . . …that small bank Information Security Officers face in 2023 Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Welcom...

“Cooked Turkey” – Awareness Poster

Another awareness poster for YOUR customers (and users). Now that we have our own employees aware, maybe it’s time to start posting content for our customers!Check out for...