Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

351–360 of 435 posts

Re: How Dropbox Hacks Your Mac

#351

Post by yborg »

frik wrote: post #349
newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

I removed the Dropbox app from my iPad when they started to require a active GPS to upload files. [about two years ago] If you disallow GPS for that app, it disallows you to upload files. Stupid decisions!?

wat. I just checked, I have Location Services set to 'Never' on Dropbox and it uploads files fine.

Re: How Dropbox Hacks Your Mac

#352

Post by brentdax »

newhouseb wrote: post #268
brentdax wrote: post #236

Earlier quoted context omitted.

> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install…

> @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs? Yep, we’re going to fix this so that if you uncheck it, we leave it unchecked. > This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possi…

I should say, Ben, thank you for coming out in public and sharing your team's perspective. Your users are angry—and I think rightly so—but it does help that we are being told why it was done, that it was merely poor judgement rather than deliberate misbehavior, and that you are working to make the Dropbox client a more responsible citizen. Is it as good as not having done it in the first place? No. But it's much better than radio silence.

Re: How Dropbox Hacks Your Mac

#353

Post by johncolanduoni »

tigershark wrote: post #340
Kadin wrote: post #180

Earlier quoted context omitted.

It's a good thing Dropbox isn't doing that, then.

Then please explain how it manages to set the accessibility privilege at every login after the user explicitly revokes it. I can see only two options: 1) the Dropbox client stores the password and uses it to hack the accesses db at every login. 2) the Dropbox client runs as root and does the same thing. Both options are simply terrible from a security point of view

Not sure if this is how they do it, but OS X has another option (which is in fact recommended by Apple for all tasks needing elevated permissions): installation of a privileged helper tool.[1] The helper tool communicates with the main app via IPC, ideally such that the only things the app can ask are precisely the things it's supposed to do (e.g. the helper will only sneak in accessibility for the dropbox app, and nobody else). The helper tool removes a lot of the surface area for security holes, assuming the IPC protocol is well written (not something like "here's this string, run it as a shell command with root privileges).

[1]: https://developer.apple.com/library/mac/documentation/Securi...

Re: How Dropbox Hacks Your Mac

#354

Post by elmigranto »

bahoom wrote: post #348
elmigranto wrote: post #135

Earlier quoted context omitted.

One example that comes to my mind, is that you won't be able to copy any data from keychain. In fact, no one can access protected keychain data, if any app that is not in Accessibility "listens to keyboard". http://apple.stackexchange.com/questions/212622/keychain-won...

Well, that's obviously a bug in OSX. I'm not saying that accessibility enabled apps can't do any harm, of course they can. My point is that they can't do more damage then regular applications you run on your mac. The only way to run third party apps in a kind of secure environment is sandboxing. All this accessibility api lockdown stuff from Apple is just pseudo-security.

> My point is that they can't do more damage then regular applications you run on your mac.

Well, they can autoconfirm Keychain prompts with simulated keyboard events (and access all the keychain data in general), for one. This is something non-accessibility apps can't do after some update.

Keylogger can't steal your password, if it's in keychain, even though it knows your root password. But I guess now it'll add itself into accessibility, so… waiting for Sierra :)

Re: How Dropbox Hacks Your Mac

#355

Post by frik »

yborg wrote: post #351
frik wrote: post #349

Earlier quoted context omitted.

I removed the Dropbox app from my iPad when they started to require a active GPS to upload files. [about two years ago] If you disallow GPS for that app, it disallows you to upload files. Stupid decisions!?

wat. I just checked, I have Location Services set to 'Never' on Dropbox and it uploads files fine.

It was about two years ago. I removed the app, never looked back. But recently came across a news that Dropbox got hacked and all passwords were captured and leaked. At the same time I received an email from them, not mentioning that (as far as I remember) but what they mentioned they will delete my account if I don't login in the next x weeks. It seems Dropbox had its peak, and it's going down-hill from there -except they do an IPO or find a someone to sell (maybe they already do just that).

Re: How Dropbox Hacks Your Mac

#356

Post by dordoka »

breatheoften wrote: post #333

Anybody know a good OS X app to scan the file system for suid binaries? I guess I could do this with find from the shell, but a little utility app with a nice ui (and possibily some integration with a database to hide or categorize by threat level) seems like a smart thing to have on my system and run every so often.

I wanted to do the same thing earlier today and found out this that might help. I know that you ask for a gui but just in case:

http://commandlinemac.blogspot.com.es/2008/12/find-suidsgid-...

Re: How Dropbox Hacks Your Mac

#357

Post by bahoom »

elmigranto wrote: post #354
bahoom wrote: post #348

Earlier quoted context omitted.

Well, that's obviously a bug in OSX. I'm not saying that accessibility enabled apps can't do any harm, of course they can. My point is that they can't do more damage then regular applications you run on your mac. The only way to run third party apps in a kind of secure environment is sandboxing. All this accessibility api lockdown stuff from Apple is just pseudo-security.

> My point is that they can't do more damage then regular applications you run on your mac. Well, they can autoconfirm Keychain prompts with simulated keyboard events (and access all the keychain data in general), for one. This is something non-accessibility apps can't do after some update. Keylogger can't steal your password, if it's in keychain, even though it knows your root password. But I guess now it'll add its…

> Well, they can autoconfirm Keychain prompts with simulated keyboard events (and access all the keychain data in general), for one. This is something non-accessibility apps can't do after some update.

Simulating keyboard (and mouse) events is easily possible for non-accessibility apps (CoreGraphics CGEvent api). In fact, AXUIElementPostKeyboardEvent is just a simple wrapper around CGPostKeyboardEvent.

Re: How Dropbox Hacks Your Mac

#358

Post by microtonal »

tigershark wrote: post #340
Kadin wrote: post #180

Earlier quoted context omitted.

It's a good thing Dropbox isn't doing that, then.

Then please explain how it manages to set the accessibility privilege at every login after the user explicitly revokes it. I can see only two options: 1) the Dropbox client stores the password and uses it to hack the accesses db at every login. 2) the Dropbox client runs as root and does the same thing. Both options are simply terrible from a security point of view

3) Dropbox installs some helper programs with the SUID bit set.

And this is what they actually do.

    % ls -l /Library/DropboxHelperTools/Dropbox_u501
    total 256
    -r-s--x--x  1 root  wheel    9632 Sep  8 20:10 dbaccessperm
    -r-s--x--x  1 root  wheel  116668 Sep  8 20:10 dbfseventsd
(Note the SUID bit and the root owner, meaning that these binaries will run with the root UID when started by a normal user.)

Re: How Dropbox Hacks Your Mac

#359

Post by hobarrera »

Vendan wrote: post #295
hobarrera wrote: post #263

Earlier quoted context omitted.

Dropbox isn't hacking anything. They show the legit OS dialog requesting permission, and the user complies blindly.

Hence why I put hacking in quotes...? I'm just pointing out that Dropbox is arguably jumping through hoops to get access to functionality that Windows gives to basically anything that gets a toehold on your system.

The fact that windows has even less security (though I'd like to think you exaggerated), doesn't justify this at all.

Re: How Dropbox Hacks Your Mac

#360

Post by teacup50 »

ptomato wrote: post #9

It looks like in 10.12 Apple has added TCC.db to SIP, so this will no longer work — Dropbox will, hopefully, actually be forced to request accessibility access like they're supposed to. I'm sure they'll still demand your admin password via a dialog that tries super hard to look like a system one to use for whatever other more or less nefarious purposes. Would be nice if there was an alternative that actually syncs as…

That last comment is ironic, given that Dropbox would literally not exist today without the runtime patching of the Finder.

There was no other way to do what they did. The only reason Apple added API was because Dropbox came up with an idea that demonstrated the need for such an API to exist.

Post reply on HN