If you want to store your data securely in the cloud, you need to properly encrypt it and be the sole owner of the cryptographic keys. Several cloud data encryption solutions exist that promise to automate this process. However, now that your cryptographic keys are stored by such a central solution, you have to trust that it cannot be compromised or else all of your precious cloud data may be at risk.
In this talk we will present an in-depth analysis of one of the leading cloud data encryption solutions. Besides describing the overall system architecture, we will discuss and demonstrate several critical vulnerabilities in the different components that can result in a full remote compromise of the solution.
For the analysis we developed a coverage-based blackbox fuzzer using the FRIDA framework. The fuzzer can be rapidly adapted to different targets and architectures and, hence, will help security researchers in analyzing other solutions. It will be released after the talk as open source.