3 ms·

What the fuck Dropbox! How do I get rid of the backdoor in /Library/Application\ Support/com.apple.TCC/TCC.db even after uninstalling Dropbox.app and rm -rf'in

by 0x0 10y ago

What the fuck Dropbox! How do I get rid of the backdoor in /Library/Application\ Support/com.apple.TCC/TCC.db even after uninstalling Dropbox.app and rm -rf'ing ~/.dropbox and /Library/DropboxHelperTools? Do I just sudo sqlite3 and delete the row? Or is there an official tool (tccutil)? Edit: Crap, there's a /Library/Extensions/Dropbox.kext too now. :(

ptomato 10y ago
should be able to just uncheck Dropbox.app in SysPrefs -> Security & Privacy -> Privacy -> Accessibility
- 0x0 10y ago
  It's not visible there, probably because I obliterated the Dropbox.app file. Currently rm -rf'ing the kext after kextunloading it and seeing the kextcache rebuilding. Why should I trust a company that gets its customer database leaked with a kext that they install via shady deceiving permission dialogs?! Uninstalled. Good riddance.
- hughw 10y ago
  No, that works only until your next reboot. DB has installed an agent that resets that setting in TCC.db a few seconds after you log in next.
  - ptomato 10y ago
    Per the person I replied to, he uninstalled Dropbox and removed the agent.
- sigjuice 10y ago
  I tried this, but looks like Dropbox shenanigans are able to silently turn it back on.
  - djrogers 10y ago
    Not in Sierra
ddp 10y ago
I did this: sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db sqlite> delete from "access" where (service=="kTCCServiceAccessibility" and client=="com.getdropbox.dropbox"); ...and it seems to have done the trick.
chmaynard 10y ago
> Crap, there's a /Library/Extensions/Dropbox.kext too Now I'm getting paranoid. My /Library/Extensions/ directory contains the following kernel extensions. I purchased Little Snitch so I knew about theirs. Anyone have any comments on the rest of them? ACS6x.kext ATTOCelerityFC8.kext ATTOExpressSASHBA2.kext ATTOExpressSASRAID2.kext ArcMSR.kext BJUSBLoad.kext CIJUSBLoad.kext CalDigitHDProDrv.kext HighPointIOP.kext HighPointRR.kext LittleSnitch.kext PromiseSTEX.kext SoftRAID.kext
- 0x0 10y ago
  I have all of those except "BJUSBLoad", "CIJUSBLoad" and "LittleSnitch".
- citruspi 10y ago
  I've got all of them except for BJUSBLoad.kext CIJUSBLoad.kext LittleSnitch.kext From some online searching, it looks like BJUSBLoad.kext and CIJUSBLoad.kext are related to Canon printers.

by 0x0 10y ago

ptomato 10y ago

should be able to just uncheck Dropbox.app in SysPrefs -> Security & Privacy -> Privacy -> Accessibility

0x0 10y ago
It's not visible there, probably because I obliterated the Dropbox.app file. Currently rm -rf'ing the kext after kextunloading it and seeing the kextcache rebuilding. Why should I trust a company that gets its customer database leaked with a kext that they install via shady deceiving permission dialogs?! Uninstalled. Good riddance.
hughw 10y ago
No, that works only until your next reboot. DB has installed an agent that resets that setting in TCC.db a few seconds after you log in next.
- ptomato 10y ago
  Per the person I replied to, he uninstalled Dropbox and removed the agent.
sigjuice 10y ago
I tried this, but looks like Dropbox shenanigans are able to silently turn it back on.
- djrogers 10y ago
  Not in Sierra

ddp 10y ago

I did this: sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db sqlite> delete from "access" where (service=="kTCCServiceAccessibility" and client=="com.getdropbox.dropbox"); ...and it seems to have done the trick.

chmaynard 10y ago

> Crap, there's a /Library/Extensions/Dropbox.kext too Now I'm getting paranoid. My /Library/Extensions/ directory contains the following kernel extensions. I purchased Little Snitch so I knew about theirs. Anyone have any comments on the rest of them? ACS6x.kext ATTOCelerityFC8.kext ATTOExpressSASHBA2.kext ATTOExpressSASRAID2.kext ArcMSR.kext BJUSBLoad.kext CIJUSBLoad.kext CalDigitHDProDrv.kext HighPointIOP.kext HighPointRR.kext LittleSnitch.kext PromiseSTEX.kext SoftRAID.kext

0x0 10y ago
I have all of those except "BJUSBLoad", "CIJUSBLoad" and "LittleSnitch".
citruspi 10y ago
I've got all of them except for BJUSBLoad.kext CIJUSBLoad.kext LittleSnitch.kext From some online searching, it looks like BJUSBLoad.kext and CIJUSBLoad.kext are related to Canon printers.