Feeds

Security researcher warns over Dropbox authentication security flaw

Knitted in insecurity

5 things you didn’t know about cloud backup

Attackers able to get their hands on a Dropbox configuration file would be able to access and download any files a user synchronises through the service without betraying any signs of compromise, a security researcher has discovered.

Derek Newton discovered that a Dropbox authentication token, stored in a config file of the Dropbox directory of a Windows PC, allows access to an associated account with the file-synchronisation service – even if a user changes his password. Dropbox allows the automatic synchronisation of files between multiple computers and mobile devices. The freemium-based service works on multiple operating system platforms and mobile devices. It also offer a web-based interface to data held through an account; these are free to consumers for storage synchronisation volumes of up to 2GB.

The Windows config file might be lifted after a machine becomes compromised via a Trojan, the most obvious attack scenario. If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords. Users will not be informed if a new computer is added to a synchronisation list.

Newton blames designs flaws in the Windows version of Dropbox for what he argues is a security weakness. It is unclear whether or not Linux, Mac OS X or mobile Dropbox authentication tokens might lend themselves to similar attacks.

Arash Ferdowsi, Dropbox's CTO, contested this assessment, arguing that if an attacker succeeded in either planting a Trojan on a PC or otherwise hacking into a machine, then all the files on the system are up for grabs anyway. Nonetheless, Ferdowsi said that the design of the Dropbox client may be improved in the light of Newton's research. Possible ideas include making sure that Dropbox authentication tokens are tied to a particular system and not portable, H Security reports. ®

5 things you didn’t know about cloud backup

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?