Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox opening my docs?

wncinfosec.com

Post reply on HN
Print view View original

21–30 of 136 posts

Re: Dropbox opening my docs?

#21

Post by gjulianm »

milkshakes wrote: post #10

really? you've already determined that it's running on an ec2 instance, but it's somehow "suspicious" that the user-agent is libreoffice? and you're a "security researcher" but "curious if this is an automated process"? please. sure, dropbox might owe an explanation (even though you certainly gave them permission to do this in their TOS), and you can call me cynical and jaded, but this seems like pretty shameless FUD…

The author of this post seems to be a friend of the founder: http://blog.threatagent.com/2013/09/whos-that-peeking-in-my-...

Re: Dropbox opening my docs?

#23

Post by tptacek »

madaxe wrote: post #11

I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…

This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.

Re: Dropbox opening my docs?

#24

Post by gjulianm »

yesbabyyes wrote: post #3

LibreOffice has a pretty powerful document conversion, which you can run headless. I'm guessing they are converting to HTML and perhaps other formats -- do they offer anything like that? Edit: You can invoke it something like this: soffice --headless --convert_to html file.doc I'm just speculating, but it seems reasonable that it would open the document just like the regular LibreOffice, fetch external resources and…

It seems like they're converting it to PDF. When you click the .doc file in Dropbox, they open a PDF preview. It fits with the fact that the buzzs I've seen are only for the .doc file, not the HTML or the XLS.

Re: Dropbox opening my docs?

#26

Post by sspiff »

> Further digging into the HoneyDocs data reveals a suspicious User Agent, LibreOffice. Now I’m curious if this is still an automated process or one that involves human interaction?

Yes, because humans use LibreOffice over SSH/X11 from an EC2 instance. Probably LibreOffice is being used for the parsing/rendering on a server. Probably for something innocent like generating thumbnails or text-only previews.

Re: Dropbox opening my docs?

#27

Post by BWStearns »

steven777400 wrote: post #4

On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human…

Dedup could just use hashing which wouldn't require opening the file with Libreoffice.

Re: Dropbox opening my docs?

#30

Post by the_mitsuhiko »

yesbabyyes wrote: post #3

LibreOffice has a pretty powerful document conversion, which you can run headless. I'm guessing they are converting to HTML and perhaps other formats -- do they offer anything like that? Edit: You can invoke it something like this: soffice --headless --convert_to html file.doc I'm just speculating, but it seems reasonable that it would open the document just like the regular LibreOffice, fetch external resources and…

That's pretty much exactly what is happening. DropBox converts documents into HTML for easy viewing on the web interface.
Post reply on HN