11–20 of 105 posts
Surely tradition requires that the title of this piece be "Is Dropbox stealing your files?". I mean, it's a complete waste of a Betteridge event.
> Betteridge's law of headlines is an adage that states: "Any headline which ends in a question mark can be answered by the word no." It is named after Ian Betteridge, a British technology journalist
Well, dropbox could just listen for fs events inside the DropBox folder; and it should, from a performance perspective as well as from a privacy point of view. And then "sends a few 100 kByte"? I hope this is a typo; if not, I would like to know what these are. (also: the OP's largish file (1MB) could easily fit into "a few 100kByte" after compression)
Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…
To calculate the hash, it needs to read the whole file, which this post claims it isn't doing.
It sounds like he guessed this based on I/O activity of the process. It could be enough to hash the beginning of the files, and compare the rest if a match is found in the database.
Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…
To calculate the hash, it needs to read the whole file, which this post claims it isn't doing.
edit: here i was bored enough > http://pastebin.com/NJEvnG1d
Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…
Why would a TLA look for a file with a known (hashable) content? Is that common? Is that to be seen as looking for "contraband", i.e. if you have a certain file, for instance some known part of a rookit, you might be an evil attacking hacker? I don't quite follow. Also, the typo "Drobpox" was fun, that's a good alias when feeling suspicious. :)
Earlier quoted context omitted.
Why would a TLA look for a file with a known (hashable) content? Is that common? Is that to be seen as looking for "contraband", i.e. if you have a certain file, for instance some known part of a rookit, you might be an evil attacking hacker? I don't quite follow. Also, the typo "Drobpox" was fun, that's a good alias when feeling suspicious. :)
Tracking spread of leaked documents?
This is a fine post, but all I can think about this situation is "or, you could just reverse the Dropbox client and find out for sure". Speculation about Dropbox stealing files seems premised on the idea that you can't know what the client is doing. But that's not even close to true. People reverse much, much harder targets than Dropbox for fun. If any version of Dropbox published to its user base ever did anything l…
Surprised and disappointed.
Surely tradition requires that the title of this piece be "Is Dropbox stealing your files?". I mean, it's a complete waste of a Betteridge event.
2 - Monitor the network usage of the Dropbox application to see if it sends enough data that it could be that file
"
I can not really say if Dropbox steals them or not. But if i were a Dropbox engineer and want to know about those newly created files, i wouldn't want to send the whole file to server at all.
- Send file name with its extension
- Send file size
Compare these to dropbox's blacklist file (imagination only) in another server. If there are any matches, mark user as "whateveryouwant"
As long as there is a network activity when a new file created, it is and will always be suspicious to its users.
I'm thinking of something like
/home/dropbox drwxrwx--- dropbox