Web-based Attacks on Host-Proof Encrypted Storage

Abstract : Cloud-based storage services, such as Wuala, and pass- word managers, such as LastPass, are examples of so- called host-proof web applications that aim to protect users from attacks on the servers that host their data. To this end, user data is encrypted on the client and the server is used only as a backup data store. Authorized users may access their data through client-side software, but for ease of use, many commercial applications also offer browser-based interfaces that enable features such as remote access, form-filling, and secure sharing. We describe a series of web-based attacks on popular host-proof applications that completely circumvent their cryptographic protections. Our attacks exploit standard web application vulnerabilities to expose flaws in the encryption mechanisms, authorization policies, and key management implemented by these applications. Our analysis suggests that host-proofing by itself is not enough to protect users from web attackers, who will simply shift their focus to flaws in client-side interfaces.
Type de document :
Communication dans un congrès
6th USENIX Workshop on Offensive Technologies (WOOT'12), 2012, Unknown, Afghanistan. pp.97--104, 2012
Liste complète des métadonnées

Littérature citée [10 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-00863383
Contributeur : Ben Smyth <>
Soumis le : lundi 4 avril 2016 - 14:44:55
Dernière modification le : mardi 12 avril 2016 - 01:07:20
Document(s) archivé(s) le : mardi 5 juillet 2016 - 14:21:52

Fichier

host_proof_woot12.pdf
Fichiers produits par l'(les) auteur(s)

Identifiants

  • HAL Id : hal-00863383, version 1

Collections

Citation

Karthikeyan Bhargavan, Antoine Delignat-Lavaud. Web-based Attacks on Host-Proof Encrypted Storage. 6th USENIX Workshop on Offensive Technologies (WOOT'12), 2012, Unknown, Afghanistan. pp.97--104, 2012. 〈hal-00863383〉

Partager

Métriques

Consultations de la notice

75

Téléchargements de fichiers

76