Dropbox Is Probably Not Stealing Your Files

#1

Post by talon88 » Tue, Mar 03, 2015, 4:06 PM UTC

Dropbox Is Probably Not Stealing Your Files
one.darrenpmeyer.com

Re: Dropbox Is Probably Not Stealing Your Files

#2

Post by sarciszewski » Tue, Mar 03, 2015, 4:21 PM UTC

Pure speculation follows.

I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting.

For example:

    1. Calculate the SHA-256 hashes for files in places of interest.
    2. Report the hashes upstream.
    3. Hey, this file matches one that the FBI/NSA is looking for via NSL.
    4. Download more stuff. Also identify the person and their location.
    5. Send agents/drones after them.

This is unlikely, but still in the realm of possibility. It's also untestable without more information. (Packet captures from the DLP device would be far more helpful in determining if anything of the sort is happening.)

Re: Dropbox Is Probably Not Stealing Your Files

#3

Post by unwind » Tue, Mar 03, 2015, 4:24 PM UTC

sarciszewski wrote: post #2

Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…

Why would a TLA look for a file with a known (hashable) content? Is that common? Is that to be seen as looking for "contraband", i.e. if you have a certain file, for instance some known part of a rookit, you might be an evil attacking hacker? I don't quite follow.

Also, the typo "Drobpox" was fun, that's a good alias when feeling suspicious. :)

Re: Dropbox Is Probably Not Stealing Your Files

#4

Post by tptacek » Tue, Mar 03, 2015, 4:24 PM UTC

This is a fine post, but all I can think about this situation is "or, you could just reverse the Dropbox client and find out for sure".

Speculation about Dropbox stealing files seems premised on the idea that you can't know what the client is doing. But that's not even close to true. People reverse much, much harder targets than Dropbox for fun. If any version of Dropbox published to its user base ever did anything like this, we'll all know soon enough.

Re: Dropbox Is Probably Not Stealing Your Files

#5

Post by rlx0x » Tue, Mar 03, 2015, 4:25 PM UTC

You upload your files to dropbox servers, how in the world can you come to the delusion that you would notice when they accessed/searched/data mined your files?!

Re: Dropbox Is Probably Not Stealing Your Files

#6

Post by radiospiel » Tue, Mar 03, 2015, 4:26 PM UTC

Well, dropbox could just listen for fs events inside the DropBox folder; and it should, from a performance perspective as well as from a privacy point of view. And then "sends a few 100 kByte"? I hope this is a typo; if not, I would like to know what these are. (also: the OP's largish file (1MB) could easily fit into "a few 100kByte" after compression)

Re: Dropbox Is Probably Not Stealing Your Files

#7

Post by 3JPLW » Tue, Mar 03, 2015, 4:29 PM UTC

rlx0x wrote: post #5

You upload your files to dropbox servers, how in the world can you come to the delusion that you would notice when they accessed/searched/data mined your files?!

(The article is about uploading files outside your dropbox folder)

Re: Dropbox Is Probably Not Stealing Your Files

#8

Post by ikeboy » Tue, Mar 03, 2015, 4:29 PM UTC

sarciszewski wrote: post #2

Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…

To calculate the hash, it needs to read the whole file, which this post claims it isn't doing.

Re: Dropbox Is Probably Not Stealing Your Files

#9

Post by lucozade » Tue, Mar 03, 2015, 4:30 PM UTC

Surely tradition requires that the title of this piece be "Is Dropbox stealing your files?". I mean, it's a complete waste of a Betteridge event.

Re: Dropbox Is Probably Not Stealing Your Files

#10

Post by sarciszewski » Tue, Mar 03, 2015, 4:32 PM UTC

ikeboy wrote: post #8

sarciszewski wrote: post #2

Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…

To calculate the hash, it needs to read the whole file, which this post claims it isn't doing.

I appear to have overlooked this detail. Good catch! :)