Feeds

Security researcher warns over Dropbox authentication security flaw

Knitted in insecurity

Providing a secure and efficient Helpdesk

Attackers able to get their hands on a Dropbox configuration file would be able to access and download any files a user synchronises through the service without betraying any signs of compromise, a security researcher has discovered.

Derek Newton discovered that a Dropbox authentication token, stored in a config file of the Dropbox directory of a Windows PC, allows access to an associated account with the file-synchronisation service – even if a user changes his password. Dropbox allows the automatic synchronisation of files between multiple computers and mobile devices. The freemium-based service works on multiple operating system platforms and mobile devices. It also offer a web-based interface to data held through an account; these are free to consumers for storage synchronisation volumes of up to 2GB.

The Windows config file might be lifted after a machine becomes compromised via a Trojan, the most obvious attack scenario. If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords. Users will not be informed if a new computer is added to a synchronisation list.

Newton blames designs flaws in the Windows version of Dropbox for what he argues is a security weakness. It is unclear whether or not Linux, Mac OS X or mobile Dropbox authentication tokens might lend themselves to similar attacks.

Arash Ferdowsi, Dropbox's CTO, contested this assessment, arguing that if an attacker succeeded in either planting a Trojan on a PC or otherwise hacking into a machine, then all the files on the system are up for grabs anyway. Nonetheless, Ferdowsi said that the design of the Dropbox client may be improved in the light of Newton's research. Possible ideas include making sure that Dropbox authentication tokens are tied to a particular system and not portable, H Security reports. ®

Providing a secure and efficient Helpdesk

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.