Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox accesses all the files in your PC?

e-siber.com

Post reply on HN
Print view View original

91–100 of 158 posts

Re: Dropbox accesses all the files in your PC?

#91

Post by tallanvor »

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined.

These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sure off the top of my head). This also means that applications monitoring for file access will catch each time this happens.

Unfortunately, whoever wrote that article does not seem to understand Window's internals, or how to determine what consists of bad or dangerous activity.

It should also be noted that Dropbox runs in the context of your own user account. It does not run as a service or elevated user, so it will only have access to the files you have access to (and that you have access to without requiring elevation).

I'm not going to claim to be a security expert, but I don't see anything that would suggest a security risk on Dropbox's part. Further, if a company has data important enough that they need to run DLP software on individual computers, they should not be allowing software such as Dropbox anyway.

Re: Dropbox accesses all the files in your PC?

#92

Post by yc1010 »

Maakuth wrote: post #86
yc1010 wrote: post #72

Earlier quoted context omitted.

They could look for bitcoin wallet files, thats what typical malware does nowadays. Could theorethically only takes the infection of one computer to strike it rich.

That would be a solid line of thought if this would be some shady adware from some unknown company. But Dropbox is valued more than $10B, that's more than twice the market cap of all Bitcoin. Even if everyone at Dropbox went criminally insane, there would be no way for them to recover even a reasonable fraction of it in BTC markets. Not to mention it would completely kill their reputation and thus the highly-valued b…

They dont have to steal the bitcoins

Collecting "metadata" such as Address X stored on Computer Y on ip address Z could be worth quite alot to likes of NSA who I am sure have plenty of incentive to monitor crypto-currencies and would either pay Dropbox to do it or alternatively bang them over the head with a hammer and make them their bitches in order to collect all sorts of juicy "metadata" on millions of people world wide.

Hell access to so much information could make for quite a political tool, remember that general in washington who was kicked out because he was having an affair and somehow his private communications via gmail drafts became public. What would prevent an opportunistic dictator from gaining absolute control over political landscape of a country if this dictator has access/control to an organization such as NSA?

Americans get up in arms over their right to be armed all the time, but they ignore (or do not realize?) that without privacy and secure communications they would never be able to organize a resistance to a totalitarian government which is better armed and could potentially (already does?) monitor everything and everyone on a scale that would make Orwell blush and spin in his grave.

Re: Dropbox accesses all the files in your PC?

#93

Post by tomp »

tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

This explains the first part (Dropbox accessing the files), but not the second part (synchronous network activity).

Re: Dropbox accesses all the files in your PC?

#94

Post by alkonaut »

fabian2k wrote: post #10

I don't see any evidence that Dropbox actually transfers files, and I'd be very surprised if that would actually happen. But if the information is correct, it does transfer some kind of information to the Dropbox servers directly after accessing files outside the sync folder. I would have liked an examination of the tranferred data, or at least a comparison of the amount of data transferred compared to the size of th…

There are different levels of information, with the last being the actual file contents. I doubt dropbox would sync file contents from unrelated files (that would be the biggest security scandal ever), but there are multiple levels of metadata that you may or may not expect Dropbox to upload. If something is uploaded after you create a file in a separate directory, I'm guessing it's one of two things

1) metadata such as a timestamp when all files in the synced folder were found up to date. 2) metadata about the non-synced file changes, such as timestamps, checksums or etc.

While 2 isn't an upload of the file contents, it's still bad enough. I wouldn't expect Dropbox to upload any data OR metadata related to my unsynced files at all.

Re: Dropbox accesses all the files in your PC?

#95

Post by umurkontaci »

tomp wrote: post #93
tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

This explains the first part (Dropbox accessing the files), but not the second part (synchronous network activity).

Dropbox is always connected and continually checks for updates, just because one sees at the same time doesn't mean they are related. I see Dropbox connections all the time whenever I look through my network.

Re: Dropbox accesses all the files in your PC?

#96

Post by umurkontaci »

bobofettfett wrote: post #32
hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect. "It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB" Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the ba…

Simple. Put up an SSL interceptor proxy and see what's going through.

Re: Dropbox accesses all the files in your PC?

#98

Post by nodata »

pudquick wrote: post #66
gnud wrote: post #60

Earlier quoted context omitted.

Just some more information: Dropbox does not read the file outside the dropbox folder. It does, however, 'QueryBasicFileInformation' and and 'QueryDirectory' when I create a file on my desktop. I'm guessing this has to do with the explorer extension.

This is the first comment in this discussion I've seen that is actually interesting and might provide an explanation. The Dropbox file status symbols are a -big hack-. Up until OS X 10.10, for instance, the file browsing interface didn't provide per-file badging at the OS API level. So they literally had to patch the running Finder process to do this. I wouldn't be surprised to learn something similar is going on wit…

They were patching the running Finder process? wtf?

Re: Dropbox accesses all the files in your PC?

#99

Post by poizan42 »

beaugunderson wrote: post #58
quotemstr wrote: post #14

Process Monitor[1] will show you every filesystem call Dropbox is making. (Like strace.) That should confirm or refute this article's claims. (You could also just collect an ETW trace and analyze it in xperf (err, WPA, of course) yourself.) [1] https://technet.microsoft.com/en-us/library/bb896645.aspx

I copied a file in C:\ and saw Dropbox access it a few moments later, followed by network activity: http://cl.ly/image/443Y1S092g1R

Uhm no. It calls QueryBasicInformation and closes it again right after.

Re: Dropbox accesses all the files in your PC?

#100

Post by abritishguy »

bobofettfett wrote: post #32
hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect. "It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB" Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the ba…

That is the only way you can watch for filesystem changes on Windows.
Post reply on HN