Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox opening my docs?

wncinfosec.com

Post reply on HN
Print view View original

81–90 of 136 posts

Re: Dropbox opening my docs?

#81

Post by mkopinsky »

blcknight wrote: post #64
gjulianm wrote: post #20

Earlier quoted context omitted.

Keyword scanning shouldn't resolve images, unless they're using OCR to read any text they have. In that case, they'd be wasting a lot of resources.

Where do you get that this is using images? Honey Docs doesn't actually explain what the callback looks like in the doc file, but it doesn't look like it has anything to do with images.

The HTML, DOC, and XLS files all have identical structure (though different content). They are all HTML, and Honey Docs is relying on Word/excel's parsing the HTML in those files to fetch the image (a 1px gif).

I downloaded the credit card Honeydoc. The content looks like:

    Nicole  Davis  4556062729618215
    Brian  Baker  4556767839126624
    Patrick  Jones  4916615717158539
    ....
    

    

    

    ....

Re: Dropbox opening my docs?

#84

Post by anonymouz »

glitch003 wrote: post #76
snowwrestler wrote: post #52

Earlier quoted context omitted.

I'm more concerned about the concept of a document that can issue a GET request just by being opened. It sounds exactly like a phishing payload.

Why? Person embeds image in the doc or html file http://2.bp.blogspot.com/-iarq5sjWDWc/TWRxt8nPegI/AAAAAAAAA_... and then when the document is opened, Word (or LibreOffice in this case) tries to pull down the image to display it. Nothing fancy.

It should at least ask if there are remote resources embedded. Like e-mail clients do.

Re: Dropbox opening my docs?

#85

Post by mkopinsky »

mkopinsky wrote: post #81
blcknight wrote: post #64

Earlier quoted context omitted.

Where do you get that this is using images? Honey Docs doesn't actually explain what the callback looks like in the doc file, but it doesn't look like it has anything to do with images.

The HTML, DOC, and XLS files all have identical structure (though different content). They are all HTML, and Honey Docs is relying on Word/excel's parsing the HTML in those files to fetch the image (a 1px gif). I downloaded the credit card Honeydoc. The content looks like: Nicole Davis 4556062729618215 Brian Baker 4556767839126624 Patrick Jones 4916615717158539 .... ....

Oh, and FTR, Excel gives a warning before opening the file. So they at least have thought through this vector (if you want to call it that).

Re: Dropbox opening my docs?

#86

Post by badman_ting »

MiguelHudnandez wrote: post #72
fleitz wrote: post #62

Earlier quoted context omitted.

Fetching via a proxy really doesn't do much, all you lose is the originating IP of the machine, the rest of the vulnerability still works. If you're thinking of egress filtering except for the proxy, you can just HTTP tunnel right through it.

Also there's a possibility of processing embedded links which point at your internal network. "How did this HTTP GET go through to my 'firewalled' PHPmyadmin site?" You have to treat all user input as if it's toxic.

That's what I was thinking too. The only thing is that this process is running on an AWS instance, so it would have to be on Dropbox's VPN or something to have any such access. Either serendipitously or intentionally, I hope these boxes don't have any connection to anything sensitive.

Re: Dropbox opening my docs?

#87

Post by badman_ting »

glitch003 wrote: post #76
snowwrestler wrote: post #52

Earlier quoted context omitted.

I'm more concerned about the concept of a document that can issue a GET request just by being opened. It sounds exactly like a phishing payload.

Why? Person embeds image in the doc or html file http://2.bp.blogspot.com/-iarq5sjWDWc/TWRxt8nPegI/AAAAAAAAA_... and then when the document is opened, Word (or LibreOffice in this case) tries to pull down the image to display it. Nothing fancy.

"Person puts some characters in the query string, and the web application reads it. Nothing fancy." I just described SQL injection.

Re: Dropbox opening my docs?

#88

Post by abstractbill »

danielweber wrote: post #79
abstractbill wrote: post #48

Earlier quoted context omitted.

The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of documents, each containing lots of these links. It doesn't seem like they should be fetching external resources at all.

There are lots of services that generate traffic on your behalf. A very general rule is that you should have to send at least as many bytes as the service does, lest you become a DDOS multiplier. I don't see a .doc file getting small enough to outsize a HTTP request inside of it, even if you used some funky compression, but I'm willing to hear otherwise. One question would be if you could upload the document once and…

One question would be if you could upload the document once and then somehow trigger a very tiny edit that causes them to rescan it.

That does seem likely - dropbox tries to only upload diffs, when a file gets changed: https://www.dropbox.com/help/8/en

Re: Dropbox opening my docs?

#89

Post by dweekly »

Dropbox uses (used?) Crocodoc to do its document previews, which would be interesting now that Crocodoc has been acquired by Box (a Dropbox competitor). Crocodoc actually ran full Windows VMs to have Word interpret Word, unlike what was speculated elsewhere here (using LibreOffice) - it turns out pretty much everything else sucks pretty badly at rendering Word docs, largely because the format is a bloody nightmare of binary encoded blobs including OLE embeds, etc. My understanding was that these VMs were run on AWS Windows instances, which explains why the document was seen opened on an AWS cluster. I know they had a fun nightmare of a time getting the right licenses from Microsoft to do this.

Re: Dropbox opening my docs?

#90

Post by brown9-2 »

milkshakes wrote: post #10

really? you've already determined that it's running on an ec2 instance, but it's somehow "suspicious" that the user-agent is libreoffice? and you're a "security researcher" but "curious if this is an automated process"? please. sure, dropbox might owe an explanation (even though you certainly gave them permission to do this in their TOS), and you can call me cynical and jaded, but this seems like pretty shameless FUD…

It really does read like an unsubtle add for the honey service.
Post reply on HN