Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox opening my docs?

wncinfosec.com

Post reply on HN
Print view View original

61–70 of 136 posts

Re: Dropbox opening my docs?

#61

Post by blcknight »

gboudrias wrote: post #50
rexreed wrote: post #33

Earlier quoted context omitted.

You might want to check out SafeMonk that does this exact thing. http://www.safemonk.com

Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.

Install EncFS and use it on your Dropbox. No account, no binary blobs needed. You can compile all the bits for EncFS yourself, if you want.

Re: Dropbox opening my docs?

#62

Post by fleitz »

Kudos wrote: post #45
MiguelHudnandez wrote: post #38

Earlier quoted context omitted.

> what other choice do they have but to fetch it? They could not fetch it and have a little blank bit in the thumbnail. Chances are they're using a library they didn't develop and did not think of the possibility of external resources being loaded. Edit: The most secure way I can think to handle preview generation is to have a virtual machine firewalled from the internet that previews a single document and is then re…

It makes more sense to have it fetch them via a proxy.

Fetching via a proxy really doesn't do much, all you lose is the originating IP of the machine, the rest of the vulnerability still works.

If you're thinking of egress filtering except for the proxy, you can just HTTP tunnel right through it.

Re: Dropbox opening my docs?

#63

Post by mikeash »

pwg wrote: post #19

Much ado about nothing. If you don't want your cloud storage provider reading the data you give them, then _encrypt_ that data _before_ you upload it.

I disagree. If you must not have your cloud storage provider reading the data you give them, then encrypt it before you upload it. However, if you merely don't want them to, but it's not a big deal if they do, there's nothing wrong with expecting them not to go trawling through your data just because they can.

Re: Dropbox opening my docs?

#64

Post by blcknight »

gjulianm wrote: post #20
blcknight wrote: post #13

Earlier quoted context omitted.

I just tried this with a doc file, and the buzz was nearly instantaneous, within seconds -- 3 buzzes total. Certainly it's automated. Paranoid part of me says it's NSA keyword scanning. I feel a little insane suggesting that, but it's certainly conceivable these days. The other possibility is Dropbox is indexing the files for search? Anyway, using Dropbox unecrypted is a terrible idea. EncFS has user-friendly fronten…

Keyword scanning shouldn't resolve images, unless they're using OCR to read any text they have. In that case, they'd be wasting a lot of resources.

Where do you get that this is using images?

Honey Docs doesn't actually explain what the callback looks like in the doc file, but it doesn't look like it has anything to do with images.

Re: Dropbox opening my docs?

#65

Post by werid »

milkshakes wrote: post #53
abstractbill wrote: post #48

Earlier quoted context omitted.

The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of documents, each containing lots of these links. It doesn't seem like they should be fetching external resources at all.

again, it's not inconceivable that they understand this as well, and have some sort of rate limiting system in place. do you have a problem with google docs converting your office files?

There was a case awhile back where Google docs helped a guy rack up a huge AWS bill.

http://www.behind-the-enemy-lines.com/2012/04/google-attack-...

Re: Dropbox opening my docs?

#66

Post by rgbrenner »

BWStearns wrote: post #27
steven777400 wrote: post #4

On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human…

Dedup could just use hashing which wouldn't require opening the file with Libreoffice.

Most dedup algos do compare the data. If you just use the hash, there's a very small chance of a hash collision causing file corruption / data loss. And depending on how common that block is, the corruption could affect a large number of files.

Its a byte comparison.. so you still wouldn't use libreoffice to compare files.

Re: Dropbox opening my docs?

#68

Post by MiguelHudnandez »

fleitz wrote: post #60
MiguelHudnandez wrote: post #38

Earlier quoted context omitted.

> what other choice do they have but to fetch it? They could not fetch it and have a little blank bit in the thumbnail. Chances are they're using a library they didn't develop and did not think of the possibility of external resources being loaded. Edit: The most secure way I can think to handle preview generation is to have a virtual machine firewalled from the internet that previews a single document and is then re…

Docker would probably be better as you don't have the huge VM overhead and is naturally reverts to it's original state.

I agree -- It's the same concept but much more efficient.

I'd set up a docker to accept a single HTTP post with the document, and to return the thumbnail. The docker can then be shut down and a new instance spun up to wait for the next document to process.

It might be wasteful to spin up a new docker for each instance, but it's the only way to prevent some exploit in LibreOffice[1] that might leak information somehow. A leak could be as terrible as embedding an entire document in the next thumbnail, or as simple as returning the wrong thumbnail (like from a previous request).

[1] LibreOffice was the user-agent that phoned home in the article.

Re: Dropbox opening my docs?

#69

Post by fleitz »

mhurron wrote: post #43
B-Con wrote: post #35

Earlier quoted context omitted.

I hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.

Content is modified by the context. Someone trying to raise warnings about a competitors product should make you question the motives.

This is equivalent to an appeal to authority.

Content is not modified by the context, a fact is either true or it is not. Everyone has a motive, it reminds me of how people call into question research sponsored by corporations as if people who work in government sponsored research are some how automatically saints with no ulterior motive.

To trust someone based on affiliate links is a quite silly line of deductive reasoning.

From the information provided it seems simple enough to verify, embed an image via URL into a doc file, upload to dropbox, see if the URL is accessed. No need to argue about motive.

Re: Dropbox opening my docs?

#70

Post by njharman »

milkshakes wrote: post #34
tptacek wrote: post #23

Earlier quoted context omitted.

This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.

to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?

>> what other choice do they have but to fetch it?

Firewall unexpected outbound connections on machines doing their processing.

Post reply on HN