Dropbox Responds to Mac 'Security Risk' Accusations [Updated]

Discussion in 'Mac Blog Discussion' started by MacRumors, Sep 12, 2016.

  1. MacRumors macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    Dropbox has said it needs to do a "better job" of communicating its OS X integration, after claims emerged online that its Mac app was phishing for user passwords and even "hacks" the operating system on installation.

    Developers of the cloud storage service were forced to reply to accusations which appeared on Hacker News that the client app was a security risk and "couldn't be trusted", because of the way it takes control of system features without asking for permission to do so.

    [​IMG]
    Dropbox gains access to Accessibility features without requesting access.

    Concerns were raised after it was demonstrated that Dropbox appears in the Security & Privacy tab for Accessibility, despite the fact that users are never prompted to grant access to the features.

    Responding to the accusations
    , Dropbox said it only asks for the permissions it needs and uses the Accessibility features for certain app integrations like Office, although the permissions aren't as "granular" as the company would like.
    Dropbox said it was working with Apple to reduce its dependence on elevated access in macOS Sierra, and will respect when people disable Dropbox's Accessibility permissions. In the meantime, Hacker News wants the firm to more explicitly outline why it needs the permissions it does.

    The latest news comes at a sensitive time for the cloud storage outfit. Two weeks ago, it was revealed that over 68 million Dropbox accounts were implicated in a hack that took place in 2012.

    Due to a password hack connected to other websites, hackers were able to sign in to "a small number" of Dropbox accounts, said the company, including an employee's who had access to a document listing an array of user email addresses. But when Dropbox announced a preventative password reset measure, it made no mention of the extent of the users touched by the four-year-old hack.

    Earlier this year, Dropbox was also forced to defend a feature called Project Infinite, which allows users to access all of the content in their account as if it is stored on their own machine, regardless of how small their hard disk is. The feature requires kernel-level access to computers in order to function, which critics suggested could leave it open to serious vulnerabilities.

    Update: Dropbox has contacted MacRumors to reiterate that it "categorically denies" its Mac client phishes for user passwords or "hacks" the operating system on installation, but agreed that "we need to do more to be more transparent and make it clearer why we need access permission to a Mac OS". The company also added that the account information stolen in 2012 was hashed and salted, meaning it is unlikely hackers were able to obtain many of the users' actual passwords.

    Article Link: Dropbox Responds to Mac 'Security Risk' Accusations [Updated]
     
  2. Sheza macrumors 68000

    Sheza

    Joined:
    Aug 14, 2010
    Location:
    Cambridge, UK
    #2
    Except, if you read the blog, it's inherently clear that Dropbox spoofed the Apple password dialogue box. So they're still not owning up to it. They say it's an Apple OSX box thing, and while it's probably true that Dropbox doesn't see or capture the password you enter, it remains clear that the dialogue box is not really an Apple one.

    [​IMG]
     
  3. keysofanxiety macrumors G3

    keysofanxiety

    Joined:
    Nov 23, 2011
    #3
    Fundementally, this whole kerfuffle comes from users not understanding what 'Allow the apps below to control your computer' in System Preferences actually means. Granted, that's a lot to do with Apple's poor wording, but it doesn't literally mean that at any time an application can take mouse & keyboard control or grant unauthorised remote access.

    Due to how locked down the newer OSs are, it's not unusual for apps to need this enabled just to access features that were readily available on earlier OS X iterations.
     
  4. Mac Fly (film), Sep 12, 2016
    Last edited: Sep 12, 2016

    Mac Fly (film) macrumors 65816

    Mac Fly (film)

    Joined:
    Feb 12, 2006
    Location:
    Ireland
    #4
    Dropbox have been doing this **** for ages. Took me ages to get rid of that "Move To Dropbox" contextual that you're never asked can they install—to which we'd say no. Hence why the snakes don't ask. Wait until Facebook or Google buys them. Increase the fun!
     
  5. Mac Fly (film) macrumors 65816

    Mac Fly (film)

    Joined:
    Feb 12, 2006
    Location:
    Ireland
    #6
    The Dropbox password dialog doesn't read like that. It says: "Please enter your computer password for dropbox to work properly".
     
  6. Nozuka macrumors 68020

    Joined:
    Jul 3, 2012
    #7
    Either you trust them or you don't. If you don't, you shouldn't give them any of your files anyway. ;)
     
  7. Mackker, Sep 12, 2016
    Last edited: Sep 12, 2016

    Mackker macrumors member

    Joined:
    May 22, 2015
    #8
    Dropbox engineer's response is total ********!
    Take a look at the attached images.
    --- Post Merged, Sep 12, 2016 ---
    No dude, there's no confusion here.
    The problems are as follows:

    1. Dropbox spoofs OSX's permissions dialog.
    2. Dropbox enables special permissions on behalf of the user instead of letting OSX enabling permissions on behalf of its user (lol, see first point to understand why).
    3. In order to be able to do point 2, Dropbox uses hacking tactics like modifying a system's database to force the OS to enable permissions (sudo, anyone? Point 1 again)
    4. If an user tries to disable the unknowingly self-given permissions, magic happens! the agent re-enables itself!

    That's PURE EVIL coming from Dropbox!

    LE:
    About UI Spoofing on OSX: http://www.symantec.com/connect/blogs/mac-os-x-dialog-box-spoofing-believe-me-i-m-system-preferences

    LE2:
    For people trying to prove that Dropbox isn't spoofing the permissions dialog, there's one more thing that might not be so obvious: how come Dropbox is able to insert its identifier in the Privacy Database?

    As far as I know, this is only possible if it has the same access privileges as an Administrator or Super User.

    So what I'm saying is that in my opinion, Dropbox really does cache the password and uses it to gain access to root and this thing goes all the way back to number one: in order to cache the password, they must have access to it right? So in order to get the password they spoof the permissions dialog.
     

    Attached Files:

  8. acctman macrumors 65816

    acctman

    Joined:
    Oct 26, 2012
    Location:
    Georgia
  9. Pakaku macrumors 68020

    Pakaku

    Joined:
    Aug 29, 2009
    #10
    When I used Dropbox, I trusted them with the minority of files I intentionally stored on their servers. Same with other sync services I use now.

    The problem is they apparently never needed access to Accessibility to function in the first place: http://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/#comment-27476
     
  10. keysofanxiety macrumors G3

    keysofanxiety

    Joined:
    Nov 23, 2011
    #11
    Hmm, that does seem pretty incriminating. However I can't see concrete proof that this is the case, other than the wording of the dialogue box being different to a standard one.

    If that dialogue box is spoofed by Dropbox itself, and not OS X, surely this would be quite a big flaw. What would stop PUPs/malware doing the same thing and completely locking down the system? Are there any existing examples of this?
     
  11. springsup macrumors 65816

    springsup

    Joined:
    Feb 14, 2013
    #12
    I always wondered why Dropbox asked for elevated permissions. It's a file-syncing daemon that syncs to somewhere in my home directory - it shouldn't need anything else.

    I've been using iCloud Drive more recently, anyway. Dropbox's iOS support is so bad, they don't even support opening files without copying. Every other cloud storage provider (e.g. Google Docs, BOX) support that feature, so you can edit documents in your cloud storage and the app syncs them back automatically.

    I thought before that Dropbox were clueless and borderline hostile towards their users. This news takes both to a whole other level.
     
  12. JosephAW macrumors 68020

    JosephAW

    Joined:
    May 14, 2012
    #13
    We were working with a non profit this week who has nothing but windows xp desktops and power book G4 laptops all in good and working order.
    We tried to install Dropbox for windows and OS X and to our dismay it worked for neither, requiring that we purchase new desktops and laptops that working perfectly fine.
    Since they have a plenty of working units they are not about to fix something that isn't broke so I'm looking into a solution using ftp servers. Something that will work with smartphones as well.
    Dropbox seems to have dropped more than box lately but the ball here.
     
  13. maflynn Moderator

    maflynn

    Staff Member

    Joined:
    May 3, 2009
    Location:
    Boston
    #14
    Can someone explain to me why this is an issue?

    I use dropbox (not much these days), but I'd like to understand why its the Allow the apps below to control your computer and what implications that means, i.e., someone from dropbox (or a hacker) can use this permission and access my system?
     
  14. Phil A. Moderator

    Phil A.

    Staff Member

    Joined:
    Apr 2, 2006
    Location:
    Shropshire, UK
    #15
    I'm not sure that's a spoofed password dialog box - it just looks like the standard elevated permissions one to me.

    Irrespective of that, though, they really shouldn't be back-dooring things like they are doing and their "explanation" is not credible
     
  15. jclardy macrumors 68040

    jclardy

    Joined:
    Oct 6, 2008
    #16
    Is it possible to hide purchases on appleTV? I want adjustment bureau and rush but I don't want garbage movies like ride along or identity theif cluttering up my collection.
     
  16. Mackker macrumors member

    Joined:
    May 22, 2015
    #17
    They couldn't do 2,3,4 without 1. Also the permissions dialog has different alignment, font weight and format than the one provided by macOS (see my attachments).
     
  17. Cindori, Sep 12, 2016
    Last edited: Sep 12, 2016

    Cindori macrumors 68040

    Cindori

    Joined:
    Jan 17, 2008
    Location:
    Sweden
    #18

    This is the first big misunderstanding in this whole affair.
    That dialogue is 100% genuine (called from Apple API's). You can customize the text that appears ("blabla for Dropbox to work correctly") using older C-API's that are still fully allowed. It is not a "custom Dropbox popup that can see your password".

    This has been called out numerous times but unfortunately news articles can't keep up and that blog doesn't seem to want to edit the post (I'm guessing they're getting peak traffic from this story).

    --------------------------------

    EDIT: Here is the actual API's to achieve this: https://developer.apple.com/library...f/#//apple_ref/c/func/AuthorizationCopyRights

    Parameter: environment
    "Data used when authorizing or preauthorizing rights. Not used in OS X v10.2 and earlier. In OS X v10.3 and later, you can pass icon or prompt data to be used in the authentication dialog box"
     
  18. Mackker macrumors member

    Joined:
    May 22, 2015
    #19
    Could you please post a link to some documentation backing up what you're saying?
     
  19. keysofanxiety macrumors G3

    keysofanxiety

    Joined:
    Nov 23, 2011
    #20
    I see. So if this is true, what would stop PUPs or OS X malware doing the same thing? Do you feel this is a potential security workaround that Apple need to address, if that's the case? It seems like an awfully obvious security flaw.

    For instance, the UAC prompt on Windows can't really be spoofed, as it would still prompt in a standalone window whenever an application is trying to make system changes.
     
  20. keysofanxiety macrumors G3

    keysofanxiety

    Joined:
    Nov 23, 2011
    #21
    If this is the case, that would make a LOT more sense.
     
  21. OldSchoolMacGuy Suspended

    OldSchoolMacGuy

    Joined:
    Jul 10, 2008
    #22
    Uuuuuh, yes it does. An app with that permission can execute clicks and text entry anywhere. We use the same mechanism to pull all the passwords from your Keychain with zero user interaction. An app with such permissions has full control of your machine and can certainly grant anyone any access it likes.
     
  22. Cindori, Sep 12, 2016
    Last edited: Sep 12, 2016

    Cindori macrumors 68040

    Cindori

    Joined:
    Jan 17, 2008
    Location:
    Sweden
    #23
    Found it: https://developer.apple.com/library...f/#//apple_ref/c/func/AuthorizationCopyRights

    This is straight from the documentation:

    Parameter: environment
    Data used when authorizing or preauthorizing rights. Not used in OS X v10.2 and earlier. In OS X v10.3 and later, you can pass icon or prompt data to be used in the authentication dialog box.

    This is what Dropbox is using.
     
  23. Mascots macrumors 68000

    Mascots

    Joined:
    Sep 5, 2009
    #24
    But are they? If they are building their own box and capturing information to access permissions, that's a no no.
     
  24. Cindori macrumors 68040

    Cindori

    Joined:
    Jan 17, 2008
    Location:
    Sweden
    #25
    I think it's pretty obvious that they are. Why would they not? The API allows it.

    The only confusion here stems from people without knowledge of these API's drawing conclusions like "they are using fake popups because the message is not like the standard popup!11!" in their efforts to find more "incriminating stuff" about Dropbox's practices.

    As for their practices in general I personally think they are designed from a UX perspective - enter password once and be done with setup and not the "conspiracy-steal-password-control-your-computer-malware" FUD that is being spread right now.
     

Share This Page

93 September 12, 2016