The paper “MEGA – Malleable Encryption Goes Awry” by Matilda Backendal, Miro Haller and Kenny Paterson from the Applied Crypto Group was accepted to the IEEE Symposium on Security & Privacy 2023.
MEGA is a cloud-based storage system with 250 million users worldwide, storing more than 1000 Petabytes of data. The team uncovered five significant cryptographic vulnerabilities in the MEGA system. These were disclosed to MEGA in March 2022 and some of them were patched in June. The work received media attention from Ars Technica, Hacker News, The Register, and more.
Further details, including the paper itself, can be found at: https://mega-awry.io.