Feeds

Security researcher warns over Dropbox authentication security flaw

Knitted in insecurity

Choosing a cloud hosting partner with confidence

Attackers able to get their hands on a Dropbox configuration file would be able to access and download any files a user synchronises through the service without betraying any signs of compromise, a security researcher has discovered.

Derek Newton discovered that a Dropbox authentication token, stored in a config file of the Dropbox directory of a Windows PC, allows access to an associated account with the file-synchronisation service – even if a user changes his password. Dropbox allows the automatic synchronisation of files between multiple computers and mobile devices. The freemium-based service works on multiple operating system platforms and mobile devices. It also offer a web-based interface to data held through an account; these are free to consumers for storage synchronisation volumes of up to 2GB.

The Windows config file might be lifted after a machine becomes compromised via a Trojan, the most obvious attack scenario. If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords. Users will not be informed if a new computer is added to a synchronisation list.

Newton blames designs flaws in the Windows version of Dropbox for what he argues is a security weakness. It is unclear whether or not Linux, Mac OS X or mobile Dropbox authentication tokens might lend themselves to similar attacks.

Arash Ferdowsi, Dropbox's CTO, contested this assessment, arguing that if an attacker succeeded in either planting a Trojan on a PC or otherwise hacking into a machine, then all the files on the system are up for grabs anyway. Nonetheless, Ferdowsi said that the design of the Dropbox client may be improved in the light of Newton's research. Possible ideas include making sure that Dropbox authentication tokens are tied to a particular system and not portable, H Security reports. ®

Beginner's guide to SSL certificates

More from The Register

next story
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
Cray-cray Met Office spaffs £97m on VERY AVERAGE HPC box
Only 250th most powerful in the world? Bring back Michael Fish
Microsoft brings the CLOUD that GOES ON FOREVER
Sky's the limit with unrestricted space in the cloud
'ANYTHING BUT STABLE' Netflix suffers BIG Europe-wide outage
Friday night LIVE? Nope. The only thing streaming are tears down my face
IBM, backing away from hardware? NEVER!
Don't be so sure, so-surers
Google roolz! Nest buys Revolv, KILLS new sales of home hub
Take my temperature, I'm feeling a little bit dizzy
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.