Dropbox Security Problem - Data Leakage

Dropbox has an issue with the way it handles link sharing that could potentially lead to data leakage.

The problem is fourfold:

• Files outside of the Public folder can be shared
• Shared files leak data about the file structure
• Deleting and replacing the shared file with another allows the new file to be leaked
• Shared files can’t be revoked

This security problem is demonstrated below.

First of all I start by creating a file called ‘PrivateFiles’ in the ‘My Dropbox’ folder. I’m going to use this to store my most private of data.

Inside that folder I’ll store ‘MyPrivateFile.txt’:

As you can see, it has some very personal data in it:

I’ve got to use my iPad for the next step, because the PC or Mac client won’t let me share a file from anything other than the Public folder (in fact I’m not sure if allowing sharing from other than the Public folder on the iPad is an oversight or not – regardless, this is the first security concern – the sharing of files from outside of the Public folder on the iPad when other clients won’t let you).

So when I look at my iPad I see the PrivateFiles folder:

And inside that I can see MyPrivateFile.txt, including the correct contents of that file:

Next, I’ll share the file by emailing a link of it:

The link that is sent is actually a short link – in this case http://db.tt/GdBSei, which redirects to http://dl.dropbox.com/0/view/1xldjhg9mbrt95s/PrivateFiles/MyPrivateFile.txt

This demonstrates the next data leakage problem – i.e. that I can see the path ‘PrivateFiles’ – I didn’t choose to share this, I only chose to share the file – this path may not be something you wish to reveal.'

The major problem happens for me after I create new file in the same directory, in this case ‘AnotherFile.txt’…

Then delete the original file…

And now rename the second file to have the same name as the original.

Note that copying a replacement file into the directory will also work, all that matters is there be a file there with the same name as the original. Now when I open the file using the link I was emailed before I get:

I get the replacement file!! Is that what anyone expects to happen? I guess I did share a link to the file, not a copy of the file, but it still doesn’t feel right – it’s not the original file!!

What makes this problem worse is that Dropbox won’t allow me to revoke shared links. That means that I’ve now published a permanent copy of whatever file ends up sitting in that folder with that name. What if it is something like resume.doc where I don’t want people to see me editing the file? Or what if it is temp.zip? Whatever it is – it is now permanently out there, permanently shared for anyone to access – no dropbox account required to access it!

Anyone want to try running through filename combinations for that db.tt domain? You don’t need to have had it shared with you as no authentication is required, you just need to hit the right URL!

Verified by Visa is just plain dumb

I hate the "Verified by Visa" program - it doesn't provide extra security... in fact it takes some away.

The whole concept of the verified by visa program is that when I pay online using my Visa card I get prompted to enter a password for my Visa card before the transaction can continue. This program is just dumb because using the VbV program is optional to merchants. This means that sometimes I get prompted to login to the program when using the card but, more often than not, I don't. So how does this protect me, the consumer? It doesn't... fake vendors will still attempt to steal credit cards from suckers and the suckers will keep giving it to them - outside of the VbV program.

But ahhh... I hear you say... the program isn't for the consumers... it's for the merchants, it verifies to them that the credit card is really being used by the owner of the card. No it doesn't! Because if I setup a fake merchant website to steal credit card details, all I need to do is add a popup at the end asking for the users VbV password... the user will happily give it to me because they've been trained to do this by Visa. You see when a merchant uses VbV I, as a consumer, get redirected from the merchants website to a supposedly Visa website (although it's not even on a visa.com URL) and asked to provide my password. This teaches users to give up their passwords to anyone who asks - bad Visa!

Similary, if someone had already stolen my credit card through some other means (and didn't have my VbV login) and they wanted to run up a bill on it or to extract money from it - they'd just choose a merchant who isn't using the VbV program - they're not prevented from using the credit card number in any real way.

If VISA really wanted a secure program then they would require you to log into your Visa account (or your bank account) and authorise the transaction apart from the merchants website... but they've skipped this step, no doubt, to make the transaction 'smoother'. The end result being that neither the customer nor the merchant are any more protected than they were before.

C'mon VISA - you should be doing more than training users to act in this way in the name of security theater.

Security in shopping

I've just been shopping and had two things happen that made me question the security of the whole process.

The first one has bugged me for a while and its about credit card security. It seems a little bit archaic that in this day and age we are required to enter a PIN when using EFTPOS for our savings accounts, but no PIN is required for a credit account. So you'd think it would be easy enough to just forge the signature right? Well, you don't even need to go to the trouble of doing that.

Many checkouts now allow you to swipe your card yourself. You swipe, you sign, and then they check your signature - but how easy would it be for someone to swap the card that they swiped for a different one when checking the signature. i.e. Someone swipes a stolen card then puts down a card of there own for signature verification - the switch could be easily done. I know that they could just check the number on the card, but the operators barely seem to have enough time to check the signature, let alone the card number.

The second thing that concerned me was that as I left the store I had to pass through those little posts that bleep at you if you're carrying stolen goods out. They bleeped at me because I'd bought and paid for my stuff in the electrical section & they hadn't properly de-cleansed it (or whatever they do). The lady came over and said "Oh, didn't they scan your things correctly, let me fix that for you"; she took me over to a desk and spent about 60 seconds swiping my 3 items over some sort of invisible force-field and then proceeded to carry them back through the posts again. "Good", she said, "all fixed". I wondered what the point of this whole charade was when I'd already passed through the only set of posts I had to when leaving the store & they didn't even bother asking to look in the backpack that I was carrying over my shoulder!!!! Pointless!

Crazy security

You've got to love some peoples idea of security. In my building security is a fairly serious matter and they've always had a policy of not being able to drop off parcels at the front security desk... of course you can't leave something there for someone to pick up either - while this may be done so as not to burden the security staff with parcels the main reason behind it (I suspect) is that they don't want you dropping off bombs or other harmful packages that would disable the guards.

But hey... its Christmas - so don't worry about dropping off your bomb with the guard... just bring it in the door wrapped in Christmas paper and leave it beside the tree (that is right next to the guards desk) where they are collecting children's gifts for charity!