How Dropbox Hacks Your Mac • Hacker News Board

Re: How Dropbox Hacks Your Mac

#41

Post by fifafu » Fri, Sep 09, 2016, 4:58 PM UTC

One thing to note: For non-sandboxed apps like Dropbox, the Accessibility API permissions don't really decrease security by a lot (in my opinion).

Most bad things can be done without the Accessibility API, e.g. apps can act as key loggers, take screenshots, encrypt all files your user can access, upload arbitrary things (unless you have a firewall enabled), synthesize mouse & keyboard events etc.

The Accessibility API makes some of those things easier, but if someone really wanted to attack you, he wouldn't need the Accessibility API.

For sandboxed apps the situation is quite different, because the Accessibility API would allow those apps to break out of the sandbox.

But of course Dropbox should have asked the user...

Re: How Dropbox Hacks Your Mac

#42

Post by dfabulich » Fri, Sep 09, 2016, 4:58 PM UTC

tomku wrote: post #6

Non-clickbait title: "How Dropbox uses the root access that you give it during installation to give itself Accessibility authorization without triggering the usual popup".

"Accessibility authorization" sounds benign, but the "authorization" it gives itself is full control of the Mac via the Accessibility API.

So, "How Dropbox uses the root access you give it during installation to gain full control of your Mac without triggering the usual popup."

Re: How Dropbox Hacks Your Mac

#43

Post by pyre » Fri, Sep 09, 2016, 4:59 PM UTC

pvdebbe wrote: post #36

tqkxzugoaupvwqr wrote: post #27

Earlier quoted context omitted.

AMP is not the solution. Anyone willing to use AMP to reduce bloat could also just not add bloat to HTML pages in the first place. And, using AMP itself adds bloat[1]. I couldn’t even read the author’s AMP version without enabling JavaScript. [1] https://www.ampproject.org/docs/get_started/create/basic_mar...

I can read all mentioned pages with NoScript enabled. But fully agreed that static pages such as blogs shouldn't require JS to show the primary content.

That depends. What about blog posts that have inline JS demos?

Re: How Dropbox Hacks Your Mac

#44

Post by niij » Fri, Sep 09, 2016, 4:59 PM UTC

koolba wrote: post #23

hyh1048576 wrote: post #14

Earlier quoted context omitted.

Great summary. But it's still some kind of hack. If every app I installed did this then my mac is closer to getting hacked. Anyway, Apps that asks for root password on installation always makes me cringe, e.g. they could turn on SSH and put a pubkey into authorized_keys, or they could upload SSH identity files. But I still proceed to enter my password.

> Anyway, Apps that asks for root password on installation always makes me cringe, e.g. they could turn on SSH and put a pubkey into authorized_keys, or they could upload SSH identity files. But I still proceed to enter my password. You don't need root to do any of those things. If you're going to run the SSH server on port 22, sure, but it can be run on any port above 1024 by a regular user in user space. If you're…

>If you're already running an SSH server, a non-root app can most likely edit your ~/.ssh/authorized_key file. It's just a regular file, nothing special about a malicious app adding an entry to it.

That file is -rw-r--r--, so only the owner or root can change it, unless I am misunderstanding you?

Re: How Dropbox Hacks Your Mac

#45

Post by pvdebbe » Fri, Sep 09, 2016, 5:02 PM UTC

pyre wrote: post #43

pvdebbe wrote: post #36

Earlier quoted context omitted.

I can read all mentioned pages with NoScript enabled. But fully agreed that static pages such as blogs shouldn't require JS to show the primary content.

That depends. What about blog posts that have inline JS demos?

That would be a reasonable exception. Of course, I'd only give the page a 5/5 rating if the JS code would be still readable even if no output would be produced.

Re: How Dropbox Hacks Your Mac

#46

Post by nkrisc » Fri, Sep 09, 2016, 5:03 PM UTC

pyre wrote: post #43

pvdebbe wrote: post #36

Earlier quoted context omitted.

I can read all mentioned pages with NoScript enabled. But fully agreed that static pages such as blogs shouldn't require JS to show the primary content.

That depends. What about blog posts that have inline JS demos?

Clearly that's an exception, I don't think that really needs to be discussed or considered when talking about static blogs not needing JavaScript.

Re: How Dropbox Hacks Your Mac

#47

Post by sbarre » Fri, Sep 09, 2016, 5:03 PM UTC

niij wrote: post #44

koolba wrote: post #23

Earlier quoted context omitted.

> Anyway, Apps that asks for root password on installation always makes me cringe, e.g. they could turn on SSH and put a pubkey into authorized_keys, or they could upload SSH identity files. But I still proceed to enter my password. You don't need root to do any of those things. If you're going to run the SSH server on port 22, sure, but it can be run on any port above 1024 by a regular user in user space. If you're…

>If you're already running an SSH server, a non-root app can most likely edit your ~/.ssh/authorized_key file. It's just a regular file, nothing special about a malicious app adding an entry to it. That file is -rw-r--r--, so only the owner or root can change it, unless I am misunderstanding you?

That app is running as you, so it is the owner of the file at that point.

Re: How Dropbox Hacks Your Mac

#48

Post by pvdebbe » Fri, Sep 09, 2016, 5:05 PM UTC

pyre wrote: post #43

pvdebbe wrote: post #36

Earlier quoted context omitted.

I can read all mentioned pages with NoScript enabled. But fully agreed that static pages such as blogs shouldn't require JS to show the primary content.

That depends. What about blog posts that have inline JS demos?

One example: in my static blog I provide very nice maths using MathJax, but I also provide fallback PNG renders of the formulae. The small JS my blog has, it reads these pictures' alt texts and renders the latex if found. This stuff is not rocket science, people just don't want to spend time on this kind of stuff.

Re: How Dropbox Hacks Your Mac

#49

Post by 0xmohit » Fri, Sep 09, 2016, 5:05 PM UTC

Moral: Avoid native apps if you can't avoid using them at all.

Re: How Dropbox Hacks Your Mac

#50

Post by Dylan16807 » Fri, Sep 09, 2016, 5:05 PM UTC

I don't really understand the conclusion here. So the scenario is you trust dropbox with your files, and you trust them with a kernel blob implementing the filesystem, but you don't trust them to silently have accessibility rights?