Doubt cast on the security of Kim Dotcom's Mega service