[deleted]
Dropbox opening my docs?
41–50 of 136 posts
Re: Dropbox opening my docs?
#42In retrospect this was a very well done ad for HoneyDocs... I checked out the service and thought it was novel... wouldn't have looked if not for this.
The article is written in a such a way that they are saying a lot by playing dumb... so hard to say it's misleading... but I know few security people who'd write something up with this tone.
Re: Dropbox opening my docs?
#43Did you bother asking Dropbox what's going on? This kinda reads like an ad for HoneyDocs...
I hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.
Content is modified by the context. Someone trying to raise warnings about a competitors product should make you question the motives.
Re: Dropbox opening my docs?
#44[deleted]
Re: Dropbox opening my docs?
#45Earlier quoted context omitted.
to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?
> what other choice do they have but to fetch it? They could not fetch it and have a little blank bit in the thumbnail. Chances are they're using a library they didn't develop and did not think of the possibility of external resources being loaded. Edit: The most secure way I can think to handle preview generation is to have a virtual machine firewalled from the internet that previews a single document and is then re…
It makes more sense to have it fetch them via a proxy.
Re: Dropbox opening my docs?
#46google cached version:
http://webcache.googleusercontent.com/search?q=cache:www.wnc...
Re: Dropbox opening my docs?
#47Site is up and down. Quick Cache: http://webcache.googleusercontent.com/search?q=cache:http://...
Re: Dropbox opening my docs?
#48Earlier quoted context omitted.
This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.
to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?
The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of documents, each containing lots of these links. It doesn't seem like they should be fetching external resources at all.
Re: Dropbox opening my docs?
#49For further analysis, I would suggest embedding something nasty into a .doc. [1] Seriously, why would Dropbox execute code in arbitrary files; the only reason I can see is some virus scanner heuristic. So then they could spin up a new vm, load the file and diff the vm with a clean one. Or as others suggested, generate thumbnails; that, together with the 10 minute delay, would imply that they are running remote code on some batch processing machine. ( Where a lot of other files are up for graps.) Either way, it does smell somewhat.
[1] I am not sure how LibreOffice does handle active content and furthermore I am not sure if there is a way to generate a ping back from LibreOffice without some kind of active content embedded. But to me at least, it somewhat implies that Dropbox, or whoever, runs LibreOffice in a not maximally locked down configuration.
Re: Dropbox opening my docs?
#50Much ado about nothing. If you don't want your cloud storage provider reading the data you give them, then _encrypt_ that data _before_ you upload it.
You might want to check out SafeMonk that does this exact thing. http://www.safemonk.com
Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong.
Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.