Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox opening my docs?

wncinfosec.com

Post reply on HN
Print view View original

51–60 of 136 posts

Re: Dropbox opening my docs?

#51

Post by rexreed »

gboudrias wrote: post #50
rexreed wrote: post #33

Earlier quoted context omitted.

You might want to check out SafeMonk that does this exact thing. http://www.safemonk.com

Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.

From what I understand, and again, I'm not with the company, it's not a cloud service, but rather downloadable / installable software that encrypts prior to storage on the disk.

Re: Dropbox opening my docs?

#52

Post by snowwrestler »

tptacek wrote: post #23
madaxe wrote: post #11

I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…

This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.

I'm more concerned about the concept of a document that can issue a GET request just by being opened. It sounds exactly like a phishing payload.

Re: Dropbox opening my docs?

#53

Post by milkshakes »

abstractbill wrote: post #48
milkshakes wrote: post #34

Earlier quoted context omitted.

to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?

The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of documents, each containing lots of these links. It doesn't seem like they should be fetching external resources at all.

again, it's not inconceivable that they understand this as well, and have some sort of rate limiting system in place. do you have a problem with google docs converting your office files?

Re: Dropbox opening my docs?

#54

Post by gboudrias »

rexreed wrote: post #51
gboudrias wrote: post #50

Earlier quoted context omitted.

Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.

From what I understand, and again, I'm not with the company, it's not a cloud service, but rather downloadable / installable software that encrypts prior to storage on the disk.

Hmm, but then why do you need an account?

And yeah, I see what you mean, but if you don't have access to the source, you don't know what they're making you install. I'm a huge FLOSS advocate, but in this specific instance it's more my paranoia talking. I believe I can trust them now, but how many clients will they need to have before the NSA blackmails them?

It's still a step forward, somewhat, but I find it hard to believe that there could be a successful product based on putting the user in full control (which is needed for real security).

Re: Dropbox opening my docs?

#55

Post by UnoriginalGuy »

milkshakes wrote: post #34
tptacek wrote: post #23

Earlier quoted context omitted.

This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.

to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?

It is possible but DropBox doesn't exactly have a good record on security.

Re: Dropbox opening my docs?

#56

Post by snowwrestler »

steven777400 wrote: post #4

On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human…

As I read it, the whole point of the "HoneyDoc" concept is that any access to the file generates a GET request. In other words it is specially crafted to ensure external resource retrieval.

Understanding the nature of the DropBox access would start with understanding how a "HoneyDoc" does what it claims it does.

Re: Dropbox opening my docs?

#57

Post by tedunangst »

mhurron wrote: post #43
B-Con wrote: post #35

Earlier quoted context omitted.

I hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.

Content is modified by the context. Someone trying to raise warnings about a competitors product should make you question the motives.

HoneyDocs is a DropBox competitor?

Re: Dropbox opening my docs?

#58

Post by smtddr »

B-Con wrote: post #35
eli wrote: post #9

Did you bother asking Dropbox what's going on? This kinda reads like an ad for HoneyDocs...

I hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.

> Be concerned with the content and only the content. If the article has it, it's legit.

Wrong. Context is everything. You cannot look at data in a vacuum. You need to look at where, why, when and how - especially when it's sensational; i.e. something that may cause someone to take action.

Re: Dropbox opening my docs?

#59

Post by fleitz »

tptacek wrote: post #23
madaxe wrote: post #11

I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…

This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.

Yup, it's massively unsafe, find a bug in LibreOffice, write exploit, gain control of the doc thumbnail servers, read everyone's newly submitted docs.

Re: Dropbox opening my docs?

#60

Post by fleitz »

MiguelHudnandez wrote: post #38
milkshakes wrote: post #34

Earlier quoted context omitted.

to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?

> what other choice do they have but to fetch it? They could not fetch it and have a little blank bit in the thumbnail. Chances are they're using a library they didn't develop and did not think of the possibility of external resources being loaded. Edit: The most secure way I can think to handle preview generation is to have a virtual machine firewalled from the internet that previews a single document and is then re…

Docker would probably be better as you don't have the huge VM overhead and is naturally reverts to it's original state.
Post reply on HN