3 ms·

I'm a little surprised to see this because OneDrive scans and provides malware information [1] where not every cloud storage does. I would expect apps, includin

by redm 7y ago

I'm a little surprised to see this because OneDrive scans and provides malware information [1] where not every cloud storage does. I would expect apps, including theirs, would make use of this and warn the user. Maybe they broke something as their malware property is currently "empty" and I don't remember it being that way. [1] https://docs.microsoft.com/en-us/onedrive/developer/rest-api/resources/malware?view=odsp-graph-online https://docs.microsoft.com/en-us/onedrive/developer/rest-api... contained in driveItems and other responses: https://docs.microsoft.com/en-us/onedrive/developer/rest-api/resources/driveitem?view=odsp-graph-online https://docs.microsoft.com/en-us/onedrive/developer/rest-api...

LinuxBender 7y ago
They didn't go into these details in the story, but could it be that the payload is encrypted and then hijacked blog sites are used to host the javascript to decrypt the payload? Asking because I have seen that a few times, but never saw it on onedrive.
- SlowRobotAhead 7y ago
  >but never saw it on onedrive. I have. It hasn't been what you suggest. You're not wrong you could host somewhere encrypted and escape detection. But that means you still need to point to a scam site to execute the package. But the way this works is that you're sent an email with a legit Microsoft domain. Sometimes even a legit Microsoft Share email that points to a onedrive stored file. The whole point is that your payload is hosted on a legit service that Apple, Dropbox, Microsoft, etc really do own. So that if you're trained to look at the URL, you see something legit, not share.filez-mikrozoft.kom I've had to instruct my employees to look at the context, not just the hosting link. Do you know this person? Where you expecting a file? If you aren't sure can you contact them via some other form than email?
  - LinuxBender 7y ago
    I am curious how they are uploading malicious content without encrypting it to evade detection. I've had coworkers (red team) use special packers to return "all green" on virustotal, but it doesn't take long for it to get flagged.
    - SlowRobotAhead 7y ago
      Yea, uploading undetectables via custom packers is what I would assume too. I think I remember reading something about how dropbox was being used by security researchers where they were storing known-bad files, and how Dropbox mitigated this risk

by redm 7y ago

LinuxBender 7y ago

They didn't go into these details in the story, but could it be that the payload is encrypted and then hijacked blog sites are used to host the javascript to decrypt the payload? Asking because I have seen that a few times, but never saw it on onedrive.

SlowRobotAhead 7y ago
>but never saw it on onedrive. I have. It hasn't been what you suggest. You're not wrong you could host somewhere encrypted and escape detection. But that means you still need to point to a scam site to execute the package. But the way this works is that you're sent an email with a legit Microsoft domain. Sometimes even a legit Microsoft Share email that points to a onedrive stored file. The whole point is that your payload is hosted on a legit service that Apple, Dropbox, Microsoft, etc really do own. So that if you're trained to look at the URL, you see something legit, not share.filez-mikrozoft.kom I've had to instruct my employees to look at the context, not just the hosting link. Do you know this person? Where you expecting a file? If you aren't sure can you contact them via some other form than email?
- LinuxBender 7y ago
  I am curious how they are uploading malicious content without encrypting it to evade detection. I've had coworkers (red team) use special packers to return "all green" on virustotal, but it doesn't take long for it to get flagged.
  - SlowRobotAhead 7y ago
    Yea, uploading undetectables via custom packers is what I would assume too. I think I remember reading something about how dropbox was being used by security researchers where they were storing known-bad files, and how Dropbox mitigated this risk