9 ms·
Dropbox opening my docs?
- Guillaume86 13y agoIsn't that a thumbnail generation from dropbox? I remember a thumbnail entry in their API.
- hoopism 13y agoThat would make sense to me. Especially since he only sees it on .doc files. Probably a thumbnail generator utility that uses LibreOffice plugin. Very interested to find out... There's a saying that likely applies here: "When you hear hoofbeats, think of horses not zebras"
- robinduckett 13y agoThumbnail generator is most likely. I'm suprised Libreoffice will allow a GET call to an external website like that though.
- yesbabyyes 13y agoLibreOffice has a pretty powerful document conversion, which you can run headless. I'm guessing they are converting to HTML and perhaps other formats -- do they offer anything like that? Edit: You can invoke it something like this: soffice --headless --convert_to html file.doc I'm just speculating, but it seems reasonable that it would open the document just like the regular LibreOffice, fetch external resources and so on.
- gjulianm 13y agoIt seems like they're converting it to PDF. When you click the .doc file in Dropbox, they open a PDF preview. It fits with the fact that the buzzs I've seen are only for the .doc file, not the HTML or the XLS.
- the_mitsuhiko 13y agoThat's pretty much exactly what is happening. DropBox converts documents into HTML for easy viewing on the web interface.
- skeletonjelly 13y agoYou seem pretty confident! Is your source you? A DropBox employee?
- icoder 13y agoabortz from DropBox has stated just this, in this thread, 4hrs before your post
- davidu 13y agoDropbox used to use Crocodoc which was just acquired by Box... And now Dropbox doesn't use Crocodoc. And now we learn about LibreOffice... Coincidence? Just pointing it out...
- altrego99 13y agoWhy would LibreOffice allow the .doc to run whatever embedded macro within it which does the job of calling home?
- steven777400 13y agoOn the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human, whether through deliberate management direction or mischief, is opening all these documents. I would more concerned about human intervention if occasionally, a document triggered a buzz some days after it had been uploaded. If all documents are showing as opened within 10 minutes, then surely it is just an anti-duplication automated agent at work.
- blcknight 13y agoI just tried this with a doc file, and the buzz was nearly instantaneous, within seconds -- 3 buzzes total. Certainly it's automated. Paranoid part of me says it's NSA keyword scanning. I feel a little insane suggesting that, but it's certainly conceivable these days. The other possibility is Dropbox is indexing the files for search? Anyway, using Dropbox unecrypted is a terrible idea. EncFS has user-friendly frontends like Boxcryptor.
- gjulianm 13y agoKeyword scanning shouldn't resolve images, unless they're using OCR to read any text they have. In that case, they'd be wasting a lot of resources.
- blcknight 13y agoWhere do you get that this is using images? Honey Docs doesn't actually explain what the callback looks like in the doc file, but it doesn't look like it has anything to do with images.
- mkopinsky 13y agoThe HTML, DOC, and XLS files all have identical structure (though different content). They are all HTML, and Honey Docs is relying on Word/excel's parsing the HTML in those files to fetch the image (a 1px gif). I downloaded the credit card Honeydoc. The content looks like: <html>Nicole Davis 4556062729618215<br /> Brian Baker 4556767839126624<br /> Patrick Jones 4916615717158539<br /> .... <br> <br> <br> .... <img src="https://honeydocs.herokuapp.com/img/html/202719bb5717d5621068780180abc593b0fedda692bd63727a510911d21fdcbf.gif"> </html>
- amvp 13y agoLibreOffice is commonly used as part of a system to convert and generate previews for MS Office files. I would assume it has something to do with thumbnail generation or preview generation. However I don't seem to see thumbnails or previews of .Doc files (I do for images - for example) on the dropbox webapp - so maybe it's something their testing?
- dotmanish 13y agoCould be this (thumbnails): https://www.dropbox.com/developers/core/docs#thumbnails https://www.dropbox.com/developers/core/docs#thumbnails
- phaer 13y agoLibreOffice is not necessarily a sign of a human involment in the process, as it comes with a commandline interface to convert documents between various formats. So it could be thumbnail generation as Guillaume86 suggested.
- eli 13y agoDid you bother asking Dropbox what's going on? This kinda reads like an ad for HoneyDocs...
- B-Con 13y agoI hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.
- eli 13y agoI'm not a big fan of the content either. If you're going to imply Dropbox is doing something sneaky then I think you owe them the basic courtesy of a chance to comment or explain before you hit publish.
- bigiain 13y ago"Sneaky" or not – it's definitely unexpected behaviour. I certainly didn't expect .doc files I store in a Dropbox folder to magically go and fetch remote resources. Whether it's "explainable" or not (and I guess the "they're generating PDF thumbnails" is a plausible explanation), Dropbox haven't taken any steps to inform users that this happens. There's little doubt that somebody will think up a way to take advantage of this to "leak" information. I wonder if this happens before or after Dropbox's dedupe step? I wonder if that provides an avenue to extract useful data?
- mhurron 13y agoContent is modified by the context. Someone trying to raise warnings about a competitors product should make you question the motives.
- tedunangst 13y agoHoneyDocs is a DropBox competitor?
- milkshakes 13y agoreally? you've already determined that it's running on an ec2 instance, but it's somehow "suspicious" that the user-agent is libreoffice? and you're a "security researcher" but "curious if this is an automated process"? please. sure, dropbox might owe an explanation (even though you certainly gave them permission to do this in their TOS), and you can call me cynical and jaded, but this seems like pretty shameless FUD that appears to be tied to an effort to shill a new product. EDIT: first i thought this was written by the HoneyDocs founder. now i'm actually unsure who the author is.
- gjulianm 13y agoThe author of this post seems to be a friend of the founder: http://blog.threatagent.com/2013/09/whos-that-peeking-in-my-dropbox.html http://blog.threatagent.com/2013/09/whos-that-peeking-in-my-...
- danielweber 13y agoThere's really no need to attack him.
- milkshakes 13y agoi'm not attacking him as a person, i'm attacking his actions, specifically in this case his shamelessly disingenuous linkbait guerrilla marketing masquerading as a public service announcement
- brown9-2 13y agoIt really does read like an unsubtle add for the honey service.
- hoffcoder 13y agoIt really does not matter if there is something more serious like a vulnerability in the question. And so what if the link was a covert advertisement, the community is still benefitted if a popular product is put under the scanner. It is a win-win.
- 13y ago
- madaxe 13y agoI would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just discovered an information disclosure (host IPs) vulnerability in dropbox.
- tptacek 13y agoThis seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.
- rpledge 13y agoOr worse, if as other threads are speculating, libreoffice is being used to generate previews of the docs then an exploit in libreoffice could be used to get access to dropbox's backend
- milkshakes 13y agoto be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?
- MiguelHudnandez 13y ago> what other choice do they have but to fetch it? They could not fetch it and have a little blank bit in the thumbnail. Chances are they're using a library they didn't develop and did not think of the possibility of external resources being loaded. Edit: The most secure way I can think to handle preview generation is to have a virtual machine firewalled from the internet that previews a single document and is then reverted.
- nonchalance 13y agoIf someone from honeydocs is reading this ... The tracking behavior depends on a tracking pixel which may not always be processed by the client. For example, with the credit_cards sample, the xls file is actually an HTML file with an img at the end (url linking to https://honeydocs.herokuapp.com/img/xls/... https://honeydocs.herokuapp.com/img/xls/...) and a client that only reads the plaintext (there are a boatload of command line utilities that fit the bill) won't fetch the image.
- deleted 13y ago[deleted]
- nigma 13y agoThey are generating PDF for online viewing. Go to your files on dropbox site and click on a .doc file. A preview popup will appear. Open/LibreOffice with Python bridge is quite handy in converting documents to PDF format and can be run in headless mode (using virtual frame buffer like xvfb) on a server.
- pwg 13y agoMuch ado about nothing. If you don't want your cloud storage provider reading the data you give them, then _encrypt_ that data _before_ you upload it.
- rexreed 13y agoYou might want to check out SafeMonk that does this exact thing. http://www.safemonk.com http://www.safemonk.com
- gboudrias 13y agoAm I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.
- rexreed 13y agoFrom what I understand, and again, I'm not with the company, it's not a cloud service, but rather downloadable / installable software that encrypts prior to storage on the disk.
- gboudrias 13y agoHmm, but then why do you need an account? And yeah, I see what you mean, but if you don't have access to the source, you don't know what they're making you install. I'm a huge FLOSS advocate, but in this specific instance it's more my paranoia talking. I believe I can trust them now, but how many clients will they need to have before the NSA blackmails them? It's still a step forward, somewhat, but I find it hard to believe that there could be a successful product based on putting the user in full control (which is needed for real security).
- rexreed 13y ago
- ryanackley 13y agoDropbox uses crocodoc for MS Office file previews in the browser as html and my guess is crocodoc's tech is based on a custom print driver for LibreOffice that converts it into html.
- deleted 13y ago[deleted]
- ck2 13y agoIt's probably just a MITM review by the NSA Flying Pig http://www.techdirt.com/articles/20130910/10470024468/flying-pig-nsa-is-running-man-middle-attacks-imitating-googles-servers.shtml http://www.techdirt.com/articles/20130910/10470024468/flying...
- sspiff 13y ago> Further digging into the HoneyDocs data reveals a suspicious User Agent, LibreOffice. Now I’m curious if this is still an automated process or one that involves human interaction? Yes, because humans use LibreOffice over SSH/X11 from an EC2 instance. Probably LibreOffice is being used for the parsing/rendering on a server. Probably for something innocent like generating thumbnails or text-only previews.
- mrbill 13y agoDedupe (at least for NetApp systems) only cares about data blocks; it wouldn't "open" a document or parse contents. https://communities.netapp.com/community/netapp-blogs/drdedupe/blog/2010/04/07/how-netapp-deduplication-works--a-primer https://communities.netapp.com/community/netapp-blogs/drdedu...
- Michael_Murray 13y agoWhat was that article the other day about "Stealing Traction" from an established player in an adjunct space? Well played, HoneyDocs... Well played.
- VBprogrammer 13y agoI hope that the servers running LibraOffice only have that job. LibraOffice has a pretty massive attack surface and its not the kind of thing I'd like to leave running on a server with another purpose while accepting documents from pretty much anyone. The only thing to see here is that DropBox is potentially opening themselves up to a vulnerability, would be interesting to see if GET file://etc/passwd worked...
- rexreed 13y agoPosted this reply elsewhere, but SafeMonk encrypts your files before they hit your harddrive and keeps them encrypted in the Dropbox cloud. It's free for personal use: http://www.safemonk.com http://www.safemonk.com. Note: this is not my product, just using it after I saw it demo'd at a TechBreakfast.
- devx 13y agoIt's so annoying when Google completely opens up archive files in Drive, too. Why would they do that?!
- deleted 13y ago[deleted]
- hoopism 13y agoIn retrospect this was a very well done ad for HoneyDocs... I checked out the service and thought it was novel... wouldn't have looked if not for this. The article is written in a such a way that they are saying a lot by playing dumb... so hard to say it's misleading... but I know few security people who'd write something up with this tone.
- deleted 13y ago[deleted]
- shmageggy 13y agogoogle cached version: http://webcache.googleusercontent.com/search?q=cache:www.wncinfosec.com/dropbox-opening-my-docs/ http://webcache.googleusercontent.com/search?q=cache:www.wnc...
- ValG 13y agoSite is up and down. Quick Cache: http://webcache.googleusercontent.com/search?q=cache:http://www.wncinfosec.com/dropbox-opening-my-docs/ http://webcache.googleusercontent.com/search?q=cache:http://...
- yk 13y agoFor further analysis, I would suggest embedding something nasty into a .doc. [1] Seriously, why would Dropbox execute code in arbitrary files; the only reason I can see is some virus scanner heuristic. So then they could spin up a new vm, load the file and diff the vm with a clean one. Or as others suggested, generate thumbnails; that, together with the 10 minute delay, would imply that they are running remote code on some batch processing machine. ( Where a lot of other files are up for graps.) Either way, it does smell somewhat. [1] I am not sure how LibreOffice does handle active content and furthermore I am not sure if there is a way to generate a ping back from LibreOffice without some kind of active content embedded. But to me at least, it somewhat implies that Dropbox, or whoever, runs LibreOffice in a not maximally locked down configuration.
- VuongN 13y agoI think this is a great example of why we should ask question about cloud security & privacy. I've written down some thoughts about this: http://vuongnguyen.com/personal-business-cloud-security.html http://vuongnguyen.com/personal-business-cloud-security.html -V.
- gocard 13y agoIn case you were wondering, I descrambled the blanked out "png" files and the filenames were "jennymccarthy[01-04].png"
- jlkinsel 13y agoTime to write a little VBScript to port scan me some Dropbox servers...
- atmosx 13y agoI don't know how to do that in VB and I'm sooo proud of it! :-P
- four12 13y agoYay Little Snitch... http://imgur.com/FfbenAb http://imgur.com/FfbenAb
- dweekly 13y agoDropbox uses (used?) Crocodoc to do its document previews, which would be interesting now that Crocodoc has been acquired by Box (a Dropbox competitor). Crocodoc actually ran full Windows VMs to have Word interpret Word, unlike what was speculated elsewhere here (using LibreOffice) - it turns out pretty much everything else sucks pretty badly at rendering Word docs, largely because the format is a bloody nightmare of binary encoded blobs including OLE embeds, etc. My understanding was that these VMs were run on AWS Windows instances, which explains why the document was seen opened on an AWS cluster. I know they had a fun nightmare of a time getting the right licenses from Microsoft to do this.
- dweekly 13y agoWhoops; I'm an idiot. The request had a UA of LibreOffice. Looks like Dropbox has indeed moved on from Crocodoc. My bad.
- whywhywhy5 13y agoI'm sure it's just the perfectly legal NSA browsing through your files. No need to worry.
- abortz 13y agoHi everyone, this is Andrew from Dropbox. We do use LibreOffice to render previews of Office documents for viewing in a browser, and have permitted external resource loading to make those previews as accurate as possible. While this could theoretically be used for DDoS, we haven’t seen any such behavior. However, just to be extra cautious we’ve temporarily disabled external resource loading while we explore alternatives.
- jayd16 13y agoTo me, the interesting part isn't that the file was read. What has me interested is that this is a clear attack vector. Want some free EC2 time? Wrap your workload in a .doc and have Dropbox foot the bill.
- gubatron 13y agoor maybe you left an openbox installation on another computer and you don't remember, and whoever has that computer likes to snoop on your .doc files, specially the ones named "passwords"
- guiambros 13y agoCoincidentally (or not), I just received the invite to beta test Sync.com [1] today. Seems a Dropbox-clone, for the privacy conscious user. They claim that all files are encrypted, and they don't have access to the keys. The encryption algorithm is still private, but they say they'll open source it soon. While I like the approach a lot more than Dropbox (that fights to obfuscate its own algorithm), I still don't feel safe. Anyone with access to the server could intercept your keys, and thus have access to your data. TrueCrypt over some cloud-based solution is still the ideal option, but the lack of support for sparse images makes me hesitant. EDIT: no affiliation with Sync.com (or Dropbox, for the matter). Just trying to find a decent cloud-based storage solution that fixes the exact problem exposed by the OP. [1] http://www.sync.com/your-privacy http://www.sync.com/your-privacy
- jasonj79 13y agohttps://crocodoc.com/customers/ https://crocodoc.com/customers/ Crocodoc is likely generating web previews of your documents.
- sdfjkl 13y agoWhen you click on a .doc file in the Dropbox web interface, you get a preview of the file in PDF format. To do this, Dropbox must open and convert the file. LibreOffice is popular for this, as it can be run in a headless API mode, reads a wide range of files and can output PDF format. So this is what happens here. The wisdom of executing "active" content embedded in such files is of course doubtful and something Dropbox should investigate. But if you want your files to be safe, you should instead use a service that encrypts them client side, which has the downside of losing the web interface that Dropbox offers (as this requires it to be able to access the decrypted files in order to serve them to you).
- losethos 13y agoRetard-nigger is fighting God. God says... Virtual-Notary.Org hereby notes that on Date: Friday September 13, 2013 16:32.43 EDT (UTC-0400) a random drawing in the range [1, 100000], inclusive, based on a hardware source of true randomness, yielded the following decision. Random Value: 31817 ----- alive; or whether they be come out for war, take them alive. 20:19 So these young men of the princes of the provinces came out of the city, and the army which followed them. 20:20 And they slew every one his man: and the Syrians fled; and Israel pursued them: and Benhadad the king of Syria escaped on an horse with the horsemen. 20:21 And the king of Israel went out, and smote the horses and chariots, and slew the Syrians with a great slaughter. 20:22 And the prophet came to the king of Israel, and said unto him, Go, strengthen thyself, and mark, and see what thou doest: for at the return of the year the king of Syria will come up against thee. 20:23 And the servants of the king of Syria said unto him, Their gods are gods of the hills; therefore they were stronger than we; but let us fight against them in the plain, and surely we shall be stronger than they. 20:24 And do this thing, Take the kings away, every man out of his place, and put captains in their rooms: 20:25 And number thee an army, like the army that thou hast lost, horse for horse, and chariot for chariot: and we will fight against them in the plain, and surely we shall be stronger than they. And he hearkened unto their voice, and did so.