6 ms·

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is actually scanning and reading all drives, which is hardly unnoticeable, or is it something else. Having network activity at the same time does not mean this file has been transferred. It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB from my various computers without me and my ISP noticing. The author should monitor Dropbox traffic volumes over a week and check if it actually exceeds synced folders size before spreading panic.

bobofettfett 12y ago
Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect. "It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB" Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the basic assumption.
- onderkalaci 12y ago
  I agree with you. The main problem is that why dropbox accesses the files that it is not permitted.
  - deleted 12y ago
    [deleted]
  - cremno 12y ago
    I don't know. I'm actually more interested in what it receives/sends.
- yc1010 12y ago
  They could look for bitcoin wallet files, thats what typical malware does nowadays. Could theorethically only takes the infection of one computer to strike it rich.
  - Maakuth 12y ago
    That would be a solid line of thought if this would be some shady adware from some unknown company. But Dropbox is valued more than $10B, that's more than twice the market cap of all Bitcoin. Even if everyone at Dropbox went criminally insane, there would be no way for them to recover even a reasonable fraction of it in BTC markets. Not to mention it would completely kill their reputation and thus the highly-valued business.
    - ttty 12y ago
      Wait some years when bitcoin is $10K and Dropbox is $0 and we'll talk again.
    - yc1010 12y ago
      They dont have to steal the bitcoins Collecting "metadata" such as Address X stored on Computer Y on ip address Z could be worth quite alot to likes of NSA who I am sure have plenty of incentive to monitor crypto-currencies and would either pay Dropbox to do it or alternatively bang them over the head with a hammer and make them their bitches in order to collect all sorts of juicy "metadata" on millions of people world wide. Hell access to so much information could make for quite a political tool, remember that general in washington who was kicked out because he was having an affair and somehow his private communications via gmail drafts became public. What would prevent an opportunistic dictator from gaining absolute control over political landscape of a country if this dictator has access/control to an organization such as NSA? Americans get up in arms over their right to be armed all the time, but they ignore (or do not realize?) that without privacy and secure communications they would never be able to organize a resistance to a totalitarian government which is better armed and could potentially (already does?) monitor everything and everyone on a scale that would make Orwell blush and spin in his grave.
    - ForHackernews 12y ago
- umurkontaci 12y ago
  Simple. Put up an SSL interceptor proxy and see what's going through.
  - a3_nm 12y ago
    Would this really work? I would expect the SSL certificate of Dropbox's servers to be hardcoded in the client, so the client would refuse to connect to an interceptor.
    - exDM69 12y ago
      The Dropbox client is running with normal user privileges on a computer that you have root access to. It should be possible to use reverse engineering/debugging tools to either bypass SSL checks or analyze the dropbox client binary to see what is being sent/recvd.
      - a3_nm 12y ago
        Sure, I'm just saying it would be less straightforward than mitmproxy. I wonder if there are tools to hook into whatever SSL library is being used (OpenSSL?) and intercept traffic before it gets encrypted and after it gets decrypted? (probably using LD_PRELOAD, like tsocks)
- abritishguy 12y ago
  That is the only way you can watch for filesystem changes on Windows.
- morganvachon 12y ago
  I would be very interested in seeing if Dropbox does the same thing the author claims, but on non-Windows OSes. There are official Dropbox packages for OS X, Debian-based Linux distros, Fedora/Redhat and derivatives, and a source release for packaging the binary for other OSes. If the same or similar activity is seen on other OSes, something's afoot. If the issue only shows up on Windows, it's likely a Windows-only issue or quirk (but could still be nefarious and only targeting Windows users, though personally I'm not that paranoid).
hvm 12y ago
He has a tool that checks for accesses on specific kinds of files and he uses that and a few specially crafted files to see what happens. That tool might even influence other processes for all we know. How does a security researcher not know about procmon? another user here did a test and found no problems.
userbinator 12y ago
This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". He has shown - and others here in the comments have verified (https://news.ycombinator.com/item?id=9136740 https://news.ycombinator.com/item?id=9136740 ) - the file access. It's not a "read contents" though, but only reading metadata. He has shown there is network activity. He has NOT shown what exactly that network activity consists of. Without that, the "steals everything" claim is just jumping to conclusions. As others here have mentioned, setup a proxy and look at the actual data being transferred. Replace the certificate in the client if you have to, to get around cert pinning. The most important part is to get the data. This should be pretty easy to do for someone who claims to have those qualifications. Shallow work indeed. This reminds me of the Samsung keylogger story a few years ago where a "security professional" ran one AV software, which falsely identified the presence of a single folder's path as a keylogger, and then based on this one data point and blind faith in his AV, claimed there was a keylogger preinstalled on some Samsung laptops. This made the news and was spread widely... yet he had not even taken the most basic step of looking at the contents of that folder, which would've instantly disproved the theory. This is an example of the right way to investigate and substiantiate your claims: http://doctorbeet.blogspot.ca/2013/11/lg-smart-tvs-logging-usb-filenames-and.html http://doctorbeet.blogspot.ca/2013/11/lg-smart-tvs-logging-u... Sadly, we'll probably see a round of "Dropbox steals your data!" going through the media before someone steps up with the truth. I personally don't use Dropbox and don't have the time to verify these claims --- but the onus should be on the one making them in the first place. "Extraordinary claims require extraordinary evidence."
lucb1e 12y ago
Maybe not file contents, but it could be uploading filenames for whatever reason. I'm not saying it is, but your assertion that it uploads all file contents is wrong.

bobofettfett 12y ago

Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect. "It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB" Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the basic assumption.

onderkalaci 12y ago
I agree with you. The main problem is that why dropbox accesses the files that it is not permitted.
- deleted 12y ago
  [deleted]
- cremno 12y ago
  I don't know. I'm actually more interested in what it receives/sends.
yc1010 12y ago
They could look for bitcoin wallet files, thats what typical malware does nowadays. Could theorethically only takes the infection of one computer to strike it rich.
- Maakuth 12y ago
  That would be a solid line of thought if this would be some shady adware from some unknown company. But Dropbox is valued more than $10B, that's more than twice the market cap of all Bitcoin. Even if everyone at Dropbox went criminally insane, there would be no way for them to recover even a reasonable fraction of it in BTC markets. Not to mention it would completely kill their reputation and thus the highly-valued business.
  - ttty 12y ago
    Wait some years when bitcoin is $10K and Dropbox is $0 and we'll talk again.
  - yc1010 12y ago
    They dont have to steal the bitcoins Collecting "metadata" such as Address X stored on Computer Y on ip address Z could be worth quite alot to likes of NSA who I am sure have plenty of incentive to monitor crypto-currencies and would either pay Dropbox to do it or alternatively bang them over the head with a hammer and make them their bitches in order to collect all sorts of juicy "metadata" on millions of people world wide. Hell access to so much information could make for quite a political tool, remember that general in washington who was kicked out because he was having an affair and somehow his private communications via gmail drafts became public. What would prevent an opportunistic dictator from gaining absolute control over political landscape of a country if this dictator has access/control to an organization such as NSA? Americans get up in arms over their right to be armed all the time, but they ignore (or do not realize?) that without privacy and secure communications they would never be able to organize a resistance to a totalitarian government which is better armed and could potentially (already does?) monitor everything and everyone on a scale that would make Orwell blush and spin in his grave.
  - ForHackernews 12y ago
umurkontaci 12y ago
Simple. Put up an SSL interceptor proxy and see what's going through.
- a3_nm 12y ago
  Would this really work? I would expect the SSL certificate of Dropbox's servers to be hardcoded in the client, so the client would refuse to connect to an interceptor.
  - exDM69 12y ago
    The Dropbox client is running with normal user privileges on a computer that you have root access to. It should be possible to use reverse engineering/debugging tools to either bypass SSL checks or analyze the dropbox client binary to see what is being sent/recvd.
    - a3_nm 12y ago
      Sure, I'm just saying it would be less straightforward than mitmproxy. I wonder if there are tools to hook into whatever SSL library is being used (OpenSSL?) and intercept traffic before it gets encrypted and after it gets decrypted? (probably using LD_PRELOAD, like tsocks)
abritishguy 12y ago
That is the only way you can watch for filesystem changes on Windows.
morganvachon 12y ago
I would be very interested in seeing if Dropbox does the same thing the author claims, but on non-Windows OSes. There are official Dropbox packages for OS X, Debian-based Linux distros, Fedora/Redhat and derivatives, and a source release for packaging the binary for other OSes. If the same or similar activity is seen on other OSes, something's afoot. If the issue only shows up on Windows, it's likely a Windows-only issue or quirk (but could still be nefarious and only targeting Windows users, though personally I'm not that paranoid).

hvm 12y ago

He has a tool that checks for accesses on specific kinds of files and he uses that and a few specially crafted files to see what happens. That tool might even influence other processes for all we know. How does a security researcher not know about procmon? another user here did a test and found no problems.

userbinator 12y ago

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". He has shown - and others here in the comments have verified (https://news.ycombinator.com/item?id=9136740 https://news.ycombinator.com/item?id=9136740 ) - the file access. It's not a "read contents" though, but only reading metadata. He has shown there is network activity. He has NOT shown what exactly that network activity consists of. Without that, the "steals everything" claim is just jumping to conclusions. As others here have mentioned, setup a proxy and look at the actual data being transferred. Replace the certificate in the client if you have to, to get around cert pinning. The most important part is to get the data. This should be pretty easy to do for someone who claims to have those qualifications. Shallow work indeed. This reminds me of the Samsung keylogger story a few years ago where a "security professional" ran one AV software, which falsely identified the presence of a single folder's path as a keylogger, and then based on this one data point and blind faith in his AV, claimed there was a keylogger preinstalled on some Samsung laptops. This made the news and was spread widely... yet he had not even taken the most basic step of looking at the contents of that folder, which would've instantly disproved the theory. This is an example of the right way to investigate and substiantiate your claims: http://doctorbeet.blogspot.ca/2013/11/lg-smart-tvs-logging-usb-filenames-and.html http://doctorbeet.blogspot.ca/2013/11/lg-smart-tvs-logging-u... Sadly, we'll probably see a round of "Dropbox steals your data!" going through the media before someone steps up with the truth. I personally don't use Dropbox and don't have the time to verify these claims --- but the onus should be on the one making them in the first place. "Extraordinary claims require extraordinary evidence."

lucb1e 12y ago

Maybe not file contents, but it could be uploading filenames for whatever reason. I'm not saying it is, but your assertion that it uploads all file contents is wrong.