Venafi predicts €10,000 Mega bounty will be paid out

Enterprise security firm Venafi claims Kim Dotcom's offer of 10,000 for the first person to crack his new Mega file storage site will be collected.

The challenge was announced through the site's blog in response to criticism over its security procedures, including the fact there is no end-to-end encryption.

In its response to the challenge, Venafi added its own criticism, stating that - as the encryption keys are stored along with the users' files on the system - user data was more vulnerable.

Calum MacLeod, EMEA director at Venafi, said: "This bizarre and, quite frankly, less secure approach to encryption seems to be in place solely to protect Mr Dotcom from prosecution, on the basis that he and his staff cannot have any knowledge of the data that is being stored on their cloud computing servers.

"While this is perhaps understandable given the fact that [he] was arrested in New Zealand 12 months ago in connection with copyright infringement surrounding his original MegaUpload file storage and sharing service, the lack of security surrounding the encryption keys leaves the system vulnerable."

Mega's password system also came in for criticism from MacLeod, as users have the double burden of supporting account authentication without disclosing that password to Mega's servers as well as outer level data encryption.

This approach, he claims, is a weak security system because obtaining the master key is based on a simple token system that can be replayed, rather than the more usual secure challenge/response technology seen on commercial services.

"This weakness could be exploited through the use of a timing vulnerability when the server compares the user's hash data, allowing a hacker to progressively learn how to access the system using multiple attempts," he said.

"We fully expect this methodology to be exploited by would-be crackers wanting to collect the 10,000 bounty," MacLeod concluded.