3 ms·
Corrected proposed non-clickbait title: "How Dropbox fakes an authorization prompt to trick you into entering credentials that it then caches in order to bypass
by thenewwazoo 10y ago
Corrected proposed non-clickbait title: "How Dropbox fakes an authorization prompt to trick you into entering credentials that it then caches in order to bypass restrictions on what root is able to do so that it can persist a security bypass mechanism."
The first bit, for me, is key.
- toomim 10y agoIt doesn't do that. It doesn't cache the credentials. It doesn't even see your password.
- SamBam 10y agoHow is it adding itself back to the list after being removed, then? (Not disbelieving you at all, I just haven't understood this part.)
- thenewwazoo 10y agotoomim is correct. Upon reading the update, it looks like it pops an OS X auth dialog to update a file (TCC.db) which is used to bypass the normal restrictions on what the root user is able to do. This bypass is used to manipulate the AX config. Slimy, slimy, slimy.
- gcr 10y agoIt adds a suid binary to /Library/DropboxHelperTools. This binary executes as root's effective user ID no matter who executes it and adds Dropbox to the accessibility list. Dropbox doesn't save your password. ...But I am wondering why one of these suid binaries is world-writable.
- gcr 10y agoah, it turns out none of the binaries is world-writable in a default installation. My mistake.