5 ms·

> Not long ago DropBox used to show you a fake dialog that then stole your administrator password. Wow. What the hell? Can you provide any sources to read abou

by trymas 7y ago

> Not long ago DropBox used to show you a fake dialog that then stole your administrator password. Wow. What the hell? Can you provide any sources to read about this more?

JustFinishedBSG 7y ago
https://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/ https://applehelpwriter.com/2016/07/28/revealing-dropboxs-di... Dropbox imitated a system dialog box in order to get your password to give itself system level permissions without asking you.
- trymas 7y ago
  Thank you. I am speechless on the behaviour from DropBox. I wonder why I have never heard of this and I do not remember any major security scandal regarding DropBox stealing your admin passwords, but maybe that information just went around me for some reason.. :) EDIT: I wonder how this was implemented, I imagine that any app, can recreate a pixel perfect dialog imitating system dialog asking for password and steal your sensitive information, though how can app add itself to accessibility list programatically? I am not knowledgable of MacOS API and somehow I think apps should be prevented to be able to do this on their own. Was it a MacOS security bug? What else DropBox did "under the hood" with admin password that we do not know of yet?
  - pilif 7y ago
    It was the OS dialog which allows apps to customize the prompt text. No need to fake anything. That article was wrong. Check the HN discussion from back in the day
- pilif 7y ago
  Only, it wasn’t a fake dialog. This is the normal OS sudo dialog which has API to allow the prompt text to be set by the application. The text could have been more specific what they need root rights for and how necessary the root rights are for continued usage, but they did not fake the dialog. It’s so hard to correct wrong information from the past. Even though discussion stemming from that article has shown that it was the system dialog, all people remember is the misinformation (albeit possibly inadvertent misinformation)
- fulldecent2 7y ago
  Safari is also vulnerable to phishing popups that are indistinguishable from Apple popups. https://privacylog.blogspot.com/2019/06/safari-zero-day-any-website-can-request.html https://privacylog.blogspot.com/2019/06/safari-zero-day-any-...

by trymas 7y ago

> Not long ago DropBox used to show you a fake dialog that then stole your administrator password. Wow. What the hell? Can you provide any sources to read about this more?

JustFinishedBSG 7y ago

https://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/ https://applehelpwriter.com/2016/07/28/revealing-dropboxs-di... Dropbox imitated a system dialog box in order to get your password to give itself system level permissions without asking you.

trymas 7y ago
Thank you. I am speechless on the behaviour from DropBox. I wonder why I have never heard of this and I do not remember any major security scandal regarding DropBox stealing your admin passwords, but maybe that information just went around me for some reason.. :) EDIT: I wonder how this was implemented, I imagine that any app, can recreate a pixel perfect dialog imitating system dialog asking for password and steal your sensitive information, though how can app add itself to accessibility list programatically? I am not knowledgable of MacOS API and somehow I think apps should be prevented to be able to do this on their own. Was it a MacOS security bug? What else DropBox did "under the hood" with admin password that we do not know of yet?
- pilif 7y ago
  It was the OS dialog which allows apps to customize the prompt text. No need to fake anything. That article was wrong. Check the HN discussion from back in the day
pilif 7y ago
Only, it wasn’t a fake dialog. This is the normal OS sudo dialog which has API to allow the prompt text to be set by the application. The text could have been more specific what they need root rights for and how necessary the root rights are for continued usage, but they did not fake the dialog. It’s so hard to correct wrong information from the past. Even though discussion stemming from that article has shown that it was the system dialog, all people remember is the misinformation (albeit possibly inadvertent misinformation)
fulldecent2 7y ago
Safari is also vulnerable to phishing popups that are indistinguishable from Apple popups. https://privacylog.blogspot.com/2019/06/safari-zero-day-any-website-can-request.html https://privacylog.blogspot.com/2019/06/safari-zero-day-any-...