Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox opening my docs?

wncinfosec.com

Post reply on HN
Print view View original

101–110 of 136 posts

Re: Dropbox opening my docs?

#101

Post by altrego99 »

madaxe wrote: post #11

I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…

Why would they open the .doc and allow it to run whatever embedded macro which does the job of calling home?

Re: Dropbox opening my docs?

#102

Post by altrego99 »

yesbabyyes wrote: post #3

LibreOffice has a pretty powerful document conversion, which you can run headless. I'm guessing they are converting to HTML and perhaps other formats -- do they offer anything like that? Edit: You can invoke it something like this: soffice --headless --convert_to html file.doc I'm just speculating, but it seems reasonable that it would open the document just like the regular LibreOffice, fetch external resources and…

Why would LibreOffice allow the .doc to run whatever embedded macro within it which does the job of calling home?

Re: Dropbox opening my docs?

#103

Post by chc »

fleitz wrote: post #73
MiguelHudnandez wrote: post #72

Earlier quoted context omitted.

Also there's a possibility of processing embedded links which point at your internal network. "How did this HTTP GET go through to my 'firewalled' PHPmyadmin site?" You have to treat all user input as if it's toxic.

Brilliant! I wonder what kind of error messages LibreOffice embeds when it can't fetch a resource... could map out the internal network pretty quickly if it has distinct error messages. Also docx files are zip files which opens the possibility of a zipbomb. I wonder if LibreOffice has protection for zipbombs.

Don't you need recursive decompression to make a zip bomb go off?

Re: Dropbox opening my docs?

#104

Post by abortz »

Hi everyone, this is Andrew from Dropbox.

We do use LibreOffice to render previews of Office documents for viewing in a browser, and have permitted external resource loading to make those previews as accurate as possible. While this could theoretically be used for DDoS, we haven’t seen any such behavior. However, just to be extra cautious we’ve temporarily disabled external resource loading while we explore alternatives.

Re: Dropbox opening my docs?

#105

Post by gboudrias »

rexreed wrote: post #95
gboudrias wrote: post #54

Earlier quoted context omitted.

Hmm, but then why do you need an account? And yeah, I see what you mean, but if you don't have access to the source, you don't know what they're making you install. I'm a huge FLOSS advocate, but in this specific instance it's more my paranoia talking. I believe I can trust them now, but how many clients will they need to have before the NSA blackmails them? It's still a step forward, somewhat, but I find it hard to…

The account is needed so you can grant authorization to others to access your files. EncFS is great if you are the only user. If you want to grant others access to your encrypted files, you need an authorization / authentication mechanism, which is why there's an account needed - for permission control. But if you're the only user / potential accessor of the files, single-user strong file-system based encryption work…

Good point. I guess you can't share data without trusting someone.

Re: Dropbox opening my docs?

#106

Post by fleitz »

chc wrote: post #103
fleitz wrote: post #73

Earlier quoted context omitted.

Brilliant! I wonder what kind of error messages LibreOffice embeds when it can't fetch a resource... could map out the internal network pretty quickly if it has distinct error messages. Also docx files are zip files which opens the possibility of a zipbomb. I wonder if LibreOffice has protection for zipbombs.

Don't you need recursive decompression to make a zip bomb go off?

Kinda... for 42.zip the first layer alone is 68GB albeit the final layer is 4.5 PB.

It wouldn't surprise me one could engineer a docx bomb that would consume gigs of memory.

Re: Dropbox opening my docs?

#107

Post by dweekly »

dweekly wrote: post #89

Dropbox uses (used?) Crocodoc to do its document previews, which would be interesting now that Crocodoc has been acquired by Box (a Dropbox competitor). Crocodoc actually ran full Windows VMs to have Word interpret Word, unlike what was speculated elsewhere here (using LibreOffice) - it turns out pretty much everything else sucks pretty badly at rendering Word docs, largely because the format is a bloody nightmare of…

Whoops; I'm an idiot. The request had a UA of LibreOffice. Looks like Dropbox has indeed moved on from Crocodoc. My bad.

Re: Dropbox opening my docs?

#108

Post by takluyver »

fleitz wrote: post #69
mhurron wrote: post #43

Earlier quoted context omitted.

Content is modified by the context. Someone trying to raise warnings about a competitors product should make you question the motives.

This is equivalent to an appeal to authority. Content is not modified by the context, a fact is either true or it is not. Everyone has a motive, it reminds me of how people call into question research sponsored by corporations as if people who work in government sponsored research are some how automatically saints with no ulterior motive. To trust someone based on affiliate links is a quite silly line of deductive re…

Certainly context is relevant. Understanding who is saying something and what their motives are helps you to judge how likely facts are to be true, and how much weight you should attach to opinions.

Calling some work into question because of the authors' motives isn't a claim that some other group has no ulterior motives at all. Certainly everyone has some motives, otherwise we would never get out of bed. But some of those motives will change the discussion more than others. E.g. when HP sponsors a study that finds that their own ink works out cheaper than buying remanufactured cartridges, it's perfectly sensible to be more suspicious of that than if a study by a consumer organisation found the same thing.

Re: Dropbox opening my docs?

#109

Post by jayd16 »

To me, the interesting part isn't that the file was read. What has me interested is that this is a clear attack vector.

Want some free EC2 time? Wrap your workload in a .doc and have Dropbox foot the bill.

Re: Dropbox opening my docs?

#110

Post by joe_the_user »

madaxe wrote: post #11

I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…

Parent: I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing

Article: Uploaded Documents to Dropbox Personal Account with Private Folders

So drop box indexes and creates thumbnails for private documents? This is because the NSA gives a bounty for friendly UIs, perhaps?

Post reply on HN