Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox accesses all the files in your PC?

e-siber.com

Post reply on HN
Print view View original

21–30 of 158 posts

Re: Dropbox accesses all the files in your PC?

#21

Post by tjohns »

rcthompson wrote: post #5
java-man wrote: post #4

"collect it all" But I wonder why we don't have application isolation as a basic design principle. Imagine an OS where applications/serices each get their own mini-filesystem, without ability to access each other's data. Would that work?

I'm pretty sure that's called Android. Or ChromeOS. Or iOS. Of course, then we just give all those permissions back to any apps that ask for them. Edit: And the modern sandbox modes in Windows and OSX.

> Of course, then we just give all those permissions back to any apps that ask for them.

At least in the case of Android, there is no permission that will give you access to the root filesystem or other apps' sandboxes. Categorically not allowed.

App data is restricted to /data/data/$PACKAGE_NAME. The rest of internal storage is either read-only or completely off-limits (especially in the case of other apps' data). The only way to access data that belongs to other apps is to share the same developer signing key, or explicitly share the data using a content provider.

The only exception is external storage (the SD card, if present). But that's because SD cards use FAT and therefore can't support per-application permissions.

Re: Dropbox accesses all the files in your PC?

#22

Post by yohui »

ivanche wrote: post #18

As you see below, Dropbox says that "only checked folders will sync to this computer" Very interesting wording. I don't want to play conspiracy theory, but it only says what will sync to the computer. It doesn't say anything about what will sync (or upload) to the cloud.

The context is choosing folders for Selective Sync, versus synchronizing the entire Dropbox folder. This is not their TOS or something.

Re: Dropbox accesses all the files in your PC?

#23

Post by java-man »

tjohns wrote: post #7
java-man wrote: post #4

"collect it all" But I wonder why we don't have application isolation as a basic design principle. Imagine an OS where applications/serices each get their own mini-filesystem, without ability to access each other's data. Would that work?

That's the basic idea behind sandboxing, and it's a model that a lot of newer OSes are moving towards, especially in mobile. Android does this for all apps, as does iOS. MacOS is also doing it for apps downloaded from the App Store. On the server side, that's also one of the things that Docker gives you.

So, if someone finds a vulnerability in Docker software and roots a process, your filesystem is safe?

The idea is not sandboxing, it's "multiverse". Each process, even an OS one, gets its own little filesystem, and connects to a limited set of interfaces explicitly permitted by the user (and that can be audited by the user).

Re: Dropbox accesses all the files in your PC?

#24

Post by psk »

Synchronizing all your files sounds like space-waste. It would be trivial to determine if dropbox does that, simply by monitoring the number of bytes sent to dropbox (Create a new file of size x, determine if the stream to dropbox transmits at least x amount of bytes) or by replacing the SSL certificate in the program with your own and then set up a fake server (This would be harder) to determine exactly what is being transmitted.

If this is indeed something nefarious, I would much rather assume it would transmit file hashes rather than the files itself. Although I can't possibly imagine this is actually true, the implications would be devastating for dropbox and it should be easy to verify by an independent third party.

Re: Dropbox accesses all the files in your PC?

#25

Post by agopaul »

orik wrote: post #16
geofft wrote: post #8

If taken at face value, this implies that Dropbox is spending their own bandwidth and storage space for data that's potentially much bigger than your actual shared folder, without charging you for it. What's actually going on here? What sort of false positives might we expect from such a program?

The article draws a pretty solid argument, if you wanted to confirm results yourself I'd suggest creating a windows vm, installing dropbox, and getting a packet capture of the traffic leaving when you drop a .docx file in the C:// directory. It's not a stretch of the imagination that dropbox could still be making a profit spending bandwidth and storage space this way. I can think of a government agency or two that wo…

You say solid, but I don't see any proof that the client actually send the file. Without something like a strace analysis, you can't really know for sure if the file was even read completely and sent to the Dropbox servers

Re: Dropbox accesses all the files in your PC?

#26

Post by hamstergene »

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist".

The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is actually scanning and reading all drives, which is hardly unnoticeable, or is it something else.

Having network activity at the same time does not mean this file has been transferred. It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB from my various computers without me and my ISP noticing. The author should monitor Dropbox traffic volumes over a week and check if it actually exceeds synced folders size before spreading panic.

Re: Dropbox accesses all the files in your PC?

#27

Post by vincentkriek »

zaroth wrote: post #15

"Access" is a bit vague. It's one thing if their 'fstat' is leaking, it's another thing if they are actually reading all the bytes of those files. Another piece of evidence I'd like to see is a mitmproxy checking out what's under that TLS session. Improper local reads are one thing, it's another thing entirely if they are communicating back file names, hashes and/or the file data actual.

Even if it's just fstat and thus metadata it's a pretty remarkable turn of events. This would mean Dropbox would have access to a list of all the files on my computer, when I've last accessed them or when I've last written to them for example. I don't think this is something dropbox should do.

I agree that it's important to find out if they are phoning this information back home, because if they don't this is still very bad but a lot less harmfull.

Re: Dropbox accesses all the files in your PC?

#29

Post by frossie »

ivanche wrote: post #18

As you see below, Dropbox says that "only checked folders will sync to this computer" Very interesting wording. I don't want to play conspiracy theory, but it only says what will sync to the computer. It doesn't say anything about what will sync (or upload) to the cloud.

That is because that is the ACTUAL purpose of that (Selective Sync) dialogue he is showing, contrary to his implication that it is related to upload configuration. When you have 2 work computers and one personal laptop, perhaps you have a CAD Drawings folder that you would like to sync between your work computers but don't want 100 GB of work stuff on your personal laptop. What the Selective Sync feature allows you to do is untick "CAD Drawings" on your laptop Dropbox settings, so that you don't fill up your disk with stuff you don't want in that machine's context. It's a nice feature.

Re: Dropbox accesses all the files in your PC?

#30

Post by [deleted] »

java-man wrote: post #23
tjohns wrote: post #7

Earlier quoted context omitted.

That's the basic idea behind sandboxing, and it's a model that a lot of newer OSes are moving towards, especially in mobile. Android does this for all apps, as does iOS. MacOS is also doing it for apps downloaded from the App Store. On the server side, that's also one of the things that Docker gives you.

So, if someone finds a vulnerability in Docker software and roots a process, your filesystem is safe? The idea is not sandboxing, it's "multiverse". Each process, even an OS one, gets its own little filesystem, and connects to a limited set of interfaces explicitly permitted by the user (and that can be audited by the user).

[deleted]
Post reply on HN