Dropbox uses crocodoc for MS Office file previews in the browser as html and my guess is crocodoc's tech is based on a custom print driver for LibreOffice that converts it into html.
[deleted]
Dropbox opening my docs?
71–80 of 136 posts
Re: Dropbox opening my docs?
#72Earlier quoted context omitted.
It makes more sense to have it fetch them via a proxy.
Fetching via a proxy really doesn't do much, all you lose is the originating IP of the machine, the rest of the vulnerability still works. If you're thinking of egress filtering except for the proxy, you can just HTTP tunnel right through it.
Also there's a possibility of processing embedded links which point at your internal network.
"How did this HTTP GET go through to my 'firewalled' PHPmyadmin site?"
You have to treat all user input as if it's toxic.
Re: Dropbox opening my docs?
#73Earlier quoted context omitted.
Fetching via a proxy really doesn't do much, all you lose is the originating IP of the machine, the rest of the vulnerability still works. If you're thinking of egress filtering except for the proxy, you can just HTTP tunnel right through it.
Also there's a possibility of processing embedded links which point at your internal network. "How did this HTTP GET go through to my 'firewalled' PHPmyadmin site?" You have to treat all user input as if it's toxic.
Brilliant! I wonder what kind of error messages LibreOffice embeds when it can't fetch a resource... could map out the internal network pretty quickly if it has distinct error messages.
Also docx files are zip files which opens the possibility of a zipbomb. I wonder if LibreOffice has protection for zipbombs.
Re: Dropbox opening my docs?
#74In case you were wondering, I descrambled the blanked out "png" files and the filenames were "jennymccarthy[01-04].png"
Re: Dropbox opening my docs?
#75Time to write a little VBScript to port scan me some Dropbox servers...
Re: Dropbox opening my docs?
#76Earlier quoted context omitted.
This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.
I'm more concerned about the concept of a document that can issue a GET request just by being opened. It sounds exactly like a phishing payload.
Why? Person embeds image in the doc or html file http://2.bp.blogspot.com/-iarq5sjWDWc/TWRxt8nPegI/AAAAAAAAA_... and then when the document is opened, Word (or LibreOffice in this case) tries to pull down the image to display it. Nothing fancy.
Re: Dropbox opening my docs?
#77Earlier quoted context omitted.
Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.
Install EncFS and use it on your Dropbox. No account, no binary blobs needed. You can compile all the bits for EncFS yourself, if you want.
That's more like it :)
Re: Dropbox opening my docs?
#78Did you bother asking Dropbox what's going on? This kinda reads like an ad for HoneyDocs...
I hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.
I translated your comment to Galician:
Eu odio iso, cada vez que un artigo menciona un servizo ou cae dun
enlace de afiliado e veredicto de alguén é que o artigo parece
publicidade. Prefire o seu contido de lectura a ser desprovisto de
mencionar os produtos ou marcas? Se bloggers nunca facer un centavo
off ligazóns afiliados?
Estar preocupado co contido e só o contido. O artigo ten iso, é
lexítimo.
Re: Dropbox opening my docs?
#79Earlier quoted context omitted.
to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?
The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of documents, each containing lots of these links. It doesn't seem like they should be fetching external resources at all.
There are lots of services that generate traffic on your behalf. A very general rule is that you should have to send at least as many bytes as the service does, lest you become a DDOS multiplier.
I don't see a .doc file getting small enough to outsize a HTTP request inside of it, even if you used some funky compression, but I'm willing to hear otherwise.
One question would be if you could upload the document once and then somehow trigger a very tiny edit that causes them to rescan it.
Re: Dropbox opening my docs?
#80really? you've already determined that it's running on an ec2 instance, but it's somehow "suspicious" that the user-agent is libreoffice? and you're a "security researcher" but "curious if this is an automated process"? please. sure, dropbox might owe an explanation (even though you certainly gave them permission to do this in their TOS), and you can call me cynical and jaded, but this seems like pretty shameless FUD…
There's really no need to attack him.