Feeds

Security researcher warns over Dropbox authentication security flaw

Knitted in insecurity

SANS - Survey on application security programs

Attackers able to get their hands on a Dropbox configuration file would be able to access and download any files a user synchronises through the service without betraying any signs of compromise, a security researcher has discovered.

Derek Newton discovered that a Dropbox authentication token, stored in a config file of the Dropbox directory of a Windows PC, allows access to an associated account with the file-synchronisation service – even if a user changes his password. Dropbox allows the automatic synchronisation of files between multiple computers and mobile devices. The freemium-based service works on multiple operating system platforms and mobile devices. It also offer a web-based interface to data held through an account; these are free to consumers for storage synchronisation volumes of up to 2GB.

The Windows config file might be lifted after a machine becomes compromised via a Trojan, the most obvious attack scenario. If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords. Users will not be informed if a new computer is added to a synchronisation list.

Newton blames designs flaws in the Windows version of Dropbox for what he argues is a security weakness. It is unclear whether or not Linux, Mac OS X or mobile Dropbox authentication tokens might lend themselves to similar attacks.

Arash Ferdowsi, Dropbox's CTO, contested this assessment, arguing that if an attacker succeeded in either planting a Trojan on a PC or otherwise hacking into a machine, then all the files on the system are up for grabs anyway. Nonetheless, Ferdowsi said that the design of the Dropbox client may be improved in the light of Newton's research. Possible ideas include making sure that Dropbox authentication tokens are tied to a particular system and not portable, H Security reports. ®

3 Big data security analytics techniques

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Kingston DataTraveler MicroDuo: Turn your phone into a 72GB beast
USB-usiness in the front, micro-USB party in the back
IBM rides nightmarish hardware landscape on OpenPOWER Consortium raft
Google mulls 'third-generation of warehouse-scale computing' on Big Blue's open chips
It's GOOD to get RAIN on your upgrade parade: Crucial M550 1TB SSD
Performance tweaks and power savings – what's not to like?
AMD's 'Seattle' 64-bit ARM server chips now sampling, set to launch in late 2014
But they won't appear in SeaMicro Fabric Compute Systems anytime soon
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.