Kim Dotcom Prepares Mega Cash Prize Encryption Challenge

When Mega launched this week as “The Privacy Company” their claims of super-security were bound to come under the highest levels of scrutiny. Predictably, security experts all over the world have been examining the site looking for flaws and any sign that user privacy could be breached. After responding to some of the critics, Kim Dotcom has announced that he will issue some kind of encryption challenge. “Let’s see what you got,” he says.

The launch of Mega last weekend went off as planned and the results so far have been nothing short of spectacular.

In a matter of days the site’s membership has gone from zero to more than a million, although how much more remains a mystery. Kim Dotcom says that no one would believe him if he revealed those stats, so he’ll keep those to himself for now.

What is fairly obvious at this point is the magnitude of the site’s traffic, which at least initially caused some huge problems. During the first few days Mega simply couldn’t cope with demand and was rendered inaccessible for many hours all over the world. In addition, some signed-up members complained of slow upload speeds.

But despite the teething problems, Mega’s traffic stats speak for themselves. Just take a look at this chart comparing similar services, each operating their own business model in the file-storage / sharing niche.


So while Mega settles down, moves out of its honeymoon period, and tries to sustain the kind of successes it’s enjoyed so far, there are ongoing questions and debates concerning the site’s key selling point – security.

While no one appears to have been able to actually break Mega or compromise the security of any of its users, a small army of security researchers have been publishing their musings, each with their own predictions of potential weaknesses in Mega and how these might affect security in the future.

When asked for comment, French security researcher Olivier Laurelli, who is better known by his alias Bluetouff, told TorrentFreak that although Mega’s team have been quite fast to react, the discovery of many little issues could lead to a big one.

“Confirmation links have already been cracked, the XSS issue could lead to private RSA theft, we also noticed SSL issues. The fact that cryptography can be disabled from the Mega side for a user without notifying him is another serious issue,” Laurelli said.

The main focus for researchers has been the security of the site’s in-browser encryption and the generation and handling of keys to decrypt that content. Some of their concerns were rounded up in an Ars article titled ‘Megabad: A quick look at the state of Mega’s encryption’.

The piece raised questions on number of security issues and today Mega responded to some of them. Although not directly admitting that any serious flaws exist, Mega acknowledges that it is in beta and that in some cases improvements can be made.


MEGA encryption (large)


For example, at the moment it’s impossible for users to change their Mega password so if they forget it they lose all their files and if someone finds out what it is, every file becomes insecure. Mega says that sometime in the future a password change feature will be added. Mega also acknowledges that if a user picks a weak password, tools like the just-released MegaCracker might be able to achieve results. Better pick a good password then – and remember it – just as users should do on any site.

Many of the other issues involving cryptography, possibly insecure Javscript code, data deduplication and mouse and keyboard entropy, were addressed by Mega – some with clarification and others with dismissal. Questions over the security of the Mega website itself will have to wait for another day.

In the meantime the debate will rage on, with security researchers on one side, Mega on the other, and wide selection of onlookers in the middle watching their exchanges like some kind of technological tennis match, with RSA keys for balls and something even more complicated for rackets.

The question is, who will win?

Currently Mega appears to be at least 30-0 up, but hackers and security researchers think they’ve identified enough flaws in the site’s game to claw a few points back, maybe not to take the match, but enough to challenge Mega’s privacy claims.

But according to Olivier Laurelli, the researcher who found security holes in the French Hadopi anti-piracy company TMG, the security implementation on Mega wasn’t put there exclusively to protect users, but to ensure legality for its operators.

“Security has been sold to the public for a good reason, it’s just a way for Kim Dotcom to say ‘my service is legal and I have no way to know if my users are doing illegal things on my website’. The poor implementation means that it’s not a user centric security, it’s just a legal one,” he adds.

All that said, for the average user there currently appears to be few serious concerns, especially when comparing Mega to the vast majority of other file-hosting sites that already encrypt nothing as standard.

Unsurprisingly, Kim Dotcom, as ever, appears completely unfazed by the scrutiny.

Developing a theme first mentioned by Mega CTO Mathias Ortmann at the launch conference, Dotcom is throwing down the gauntlet to would-be hackers who think they can crack Mega’s security – or maybe even provide a better system of their own.

“We welcome the ongoing #Mega security debate & will offer a cash prize encryption challenge soon. Let’s see what you got,” he announced a couple of hours ago.

There will no shortage of takers but the question remains – will Mega ever have to pay out? Maybe, maybe not – but whatever happens Laurelli believes the process will be beneficial.

“The challenge for securing Mega is quite interesting and will probably reveal the weakness of the RSA key generation process. We actually do not have enough parameters for a good entropy,” he concludes.