« Back to blog

A potential security issue when using Bitcasa

Bitcasa is the latest offline storage technology that is starting to make waves in the tech media. It's being advertised using the strapline 'Infinite storage on your desktop'. Yes, infinite storage. Think Dropbox on steroids.

The service, currently in beta, allows you to mount folders from their online servers and make them appear like local folders. There is a web interface that gives you access to your files along with hints that iOS/Android access will be available at some point too.

Of course, you can't store everything locally, so you do have to download/upload files as needed but you can set a quite large cache (up to 14 GB) to essentially keep your most used files local.

The technology is based on FUSE (thanks to @modernscientist for pointing this out), but it blurs the lines between what is local and what is remote. However, because all of your 'cloudified' folders (to borrow from Bitcasa's terminology) are each mounted as a network drive, this does create the following problem (on Macs anyway).

 Once you cloudify any folder, the file permissions of everything in that folder are all turned on. I.e. any user who has access to your computer can read and write to the files in that folder.

I created a test folder with some basic text files and I added this to Bitcasa. This is how the local permissions of that folder looked to me:

drwxrwxrwx@ 6 keith staff 204 Jan 16 08:59:02 2012 Test/

In the terminal, I then switched to a backup user account (Steve) that I have on my Mac. To that user, the permissions of the same folder look like this:

drwxrwxrwx@ 6 steve staff 204 Jan 16 08:59 Test/

I then tried deleting the folder while logged in as Steve:

$ rm -rf Test/
rm: Test/: Resource busy

It can't delete the folder, but it does delete all the files inside it. This has huge security implications if you share a computer with someone else (with a different account), or if you have an account on a networked machine. If so, then any user — intentionally or otherwise — can read and delete the contents of any folder that you add to Bitcasa.

This is, of course, no different to what happens if you leave a USB drive plugged in to your Mac, but I'm guessing that the average Bitcasa user might not realize this.

Updates

Updated 1/16/12 1:33 pm to clarify that it is based on FUSE technology rather than appearing to be FUSE-like

| Viewed
times
Filed under: