Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox accesses all the files in your PC?

e-siber.com

Post reply on HN
Print view View original

61–70 of 158 posts

Re: Dropbox accesses all the files in your PC?

#61

Post by pjmlp »

tjohns wrote: post #21
rcthompson wrote: post #5

Earlier quoted context omitted.

I'm pretty sure that's called Android. Or ChromeOS. Or iOS. Of course, then we just give all those permissions back to any apps that ask for them. Edit: And the modern sandbox modes in Windows and OSX.

> Of course, then we just give all those permissions back to any apps that ask for them. At least in the case of Android, there is no permission that will give you access to the root filesystem or other apps' sandboxes. Categorically not allowed. App data is restricted to /data/data/$PACKAGE_NAME. The rest of internal storage is either read-only or completely off-limits (especially in the case of other apps' data). T…

I lost track of the whole discussion and only do Android occasionally as hobby, but I think SD card access had some security changes as of 4.4.

Re: Dropbox accesses all the files in your PC?

#62

Post by icebraining »

pudquick wrote: post #55
flipp3r wrote: post #46

I'm not a Dropbox user, but why doesn't anyone with Dropbox just install a local proxy and try to read out the requests made to the Dropbox servers. The speculations on spying, etc. in this thread are completely worthles, just look at what they're sending to the servers.

FYI - they do certificate pinning for their clients and won't let you proxy the HTTPS connections, last I checked. I'm not saying this as cause for alarm. Obviously if they were sending the files you could measure the volume of traffic if nothing else. Make a completely random non-compressible file that's of an arbitrarily significant size (say 1M+) and see if that amount of traffic goes out to them. I do think Dropb…

Maybe

  sed -i 's/old certificate/new certificate/g' /usr/bin/dropbox
Used to work in some software.

EDIT: Matasano has a nice guide for bypassing OpenSSL cert pinning (for iOS apps, but the techniques should be more broadly applicable): http://chargen.matasano.com/chargen/2015/1/6/bypassing-opens...

Re: Dropbox accesses all the files in your PC?

#63

Post by hvm »

gnud wrote: post #56

I just had a quick look at dropbox with ProcMon, and I learned that 1) when I created a new text file on my desktop, it was not read by Dropbox 2) when I created a new text file in my dropbox folder, it was immideately read by Dropbox 3) I have to find some sync tool that doesn't feel the need to enumerate my network interfaces 3 times every second, when nothing is actually changing.

Have you heard/tried Bittorrent sync? It's P2P, doesn't put your files on their server. Very fast for transferring locally between your phone and computer for example. You have to keep your computer running if you want your files accesible anytime though.

Re: Dropbox accesses all the files in your PC?

#64

Post by hvm »

zzleeper wrote: post #31

Independently of whether DB reads/uploads all the files or not, I've arrived at a difficult position about Dropbox: I'm looking for alternatives. No, it's unrelated with politics or pricing; it's just that in many cases Dropbox sucks . Why? Well, I mostly don't care about all the new features (mobile, Carousel, etc.). What I care the most is that i) it syncs files and ii) acts as a quasi-backup. However, I see the sa…

Try Bittorrent sync, it matches all your conditions

Re: Dropbox accesses all the files in your PC?

#65

Post by hamstergene »

pudquick wrote: post #55
flipp3r wrote: post #46

I'm not a Dropbox user, but why doesn't anyone with Dropbox just install a local proxy and try to read out the requests made to the Dropbox servers. The speculations on spying, etc. in this thread are completely worthles, just look at what they're sending to the servers.

FYI - they do certificate pinning for their clients and won't let you proxy the HTTPS connections, last I checked. I'm not saying this as cause for alarm. Obviously if they were sending the files you could measure the volume of traffic if nothing else. Make a completely random non-compressible file that's of an arbitrarily significant size (say 1M+) and see if that amount of traffic goes out to them. I do think Dropb…

One can hack Windows HTTPS libs (or OpenSSL, whatever it is) inside Dropbox process and read unencrypted buffers from memory. Standard and well-documented APIs are easy to locate and hook, especially in dynamic libraries.

Re: Dropbox accesses all the files in your PC?

#66

Post by pudquick »

gnud wrote: post #60
gnud wrote: post #56

I just had a quick look at dropbox with ProcMon, and I learned that 1) when I created a new text file on my desktop, it was not read by Dropbox 2) when I created a new text file in my dropbox folder, it was immideately read by Dropbox 3) I have to find some sync tool that doesn't feel the need to enumerate my network interfaces 3 times every second, when nothing is actually changing.

Just some more information: Dropbox does not read the file outside the dropbox folder. It does, however, 'QueryBasicFileInformation' and and 'QueryDirectory' when I create a file on my desktop. I'm guessing this has to do with the explorer extension.

This is the first comment in this discussion I've seen that is actually interesting and might provide an explanation.

The Dropbox file status symbols are a -big hack-. Up until OS X 10.10, for instance, the file browsing interface didn't provide per-file badging at the OS API level. So they literally had to patch the running Finder process to do this.

I wouldn't be surprised to learn something similar is going on with Windows Explorer.

Re: Dropbox accesses all the files in your PC?

#68

Post by [deleted] »

beaugunderson wrote: post #58
quotemstr wrote: post #14

Process Monitor[1] will show you every filesystem call Dropbox is making. (Like strace.) That should confirm or refute this article's claims. (You could also just collect an ETW trace and analyze it in xperf (err, WPA, of course) yourself.) [1] https://technet.microsoft.com/en-us/library/bb896645.aspx

I copied a file in C:\ and saw Dropbox access it a few moments later, followed by network activity: http://cl.ly/image/443Y1S092g1R

[deleted]

Re: Dropbox accesses all the files in your PC?

#69

Post by Already__Taken »

smackay wrote: post #51
mappu wrote: post #40

Earlier quoted context omitted.

GPL Unison? Add in encfs with a cheap storage VPS for off-site redundancy. It should run on android too if you have a normal-looking chroot installed.

Unison was the first thing I tried after moving away from DropBox. The main problem I had with it was that both machines involved in the syncing had to be running which made moving from laptop to desktop not as seamless as I would have liked. Still the syncing process was flawless. I had better results using Seafile, http://seafile.com/en/home/ , their free account was sufficient for my needs and worked great. You ca…

You'll have that problem with anything you don't run yourself so that seems like an unfair complaint. Can't this sync desktop server and laptop server?

Re: Dropbox accesses all the files in your PC?

#70

Post by hvm »

hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

He has a tool that checks for accesses on specific kinds of files and he uses that and a few specially crafted files to see what happens. That tool might even influence other processes for all we know.

How does a security researcher not know about procmon? another user here did a test and found no problems.

Post reply on HN