Dropbox Update – A password problem

Private details of some of Dropbox’s 25 million users were exposed overnight after a bungled code update nullified account password security. The glitch allowed accounts on the free cloud storage system – ostensibly protected by “military” security systems – to be accessed with any password.  Accounts were exposed for up to four hours, although the glitch was fixed in less than five minutes after it was reported.

Dropbox co-founder Arash Ferdowsi said less than 1 percent of users – about 250,000 – had accessed accounts while the passwords were exposed. “Yesterday we made a code update at 1:54pm Pacific time that introduced a bug affecting our authentication mechanism,” Ferdowsi wrote in a blog post today.

“A very small number of users logged in during that period, some of whom could have logged into an account without the correct password. As a precaution, we ended all logged in sessions.” Ferdowsi said the company is conducting an investigation and will notify affected users. “This should never have happened. We are scrutinising our controls and we will be implementing additional safeguards to prevent this from happening again.”

Meanwhile, administrators who are trying to access dropbox accounts on a computer used on their network, now have a powerful tool. You must have access to the files on the local computer. This too is a forensic tool and allows private files on the Dropbox online hosting service to be read.

Its developer, ATC-NY, claims the tool will reveal a user’s email address, Dropbox identifier, recent files and shared directories. The company claims that it “uses the same secure methods as banks and the military” and prevents its staff from accessing customer data. The tool is called Dropbox Reader and it could make it easier for investigators to crack open Dropbox. The program is a series of six command-line Python scripts that parse Dropbox configuration and cache files using Windows, Mac OS X, and Linux.

ATC-NY described the functions of each Python script:

  1. read_config: script outputs the contents of the Dropbox config.db file in human-readable form. This includes the user’s registered e-mail address and Dropbox identifier, software version information, and a list of the most-recently-changed files.
  2. read_filecache_config: script outputs configuration information from the Dropbox filecache.db file. This includes information about shared directories that are attached to the user’s Dropbox account.
  3. read_filejournal: script outputs information about Dropbox synchronised files stored in the filecache.db file. This includes local and server-side metadata and a list of block hashes for each Dropbox-synchronised file.
  4. read_sigstore: script outputs information from the Dropbox sigstore.db file, which is an additional source of block hashes.
  5. hash_blocks: script produces a block hash list for any file. This block hash list can be compared to the block hashes from read_filejournal or read_sigstore.
  6. dropbox_contains_file: script hashes one or more files (as per hash_blocks) and compares the resulting block hash list to the files listed in filecache.db (as per read_filejournal) and reports whether the files are partially or exactly the same as any Dropbox-synchronised files.

About SCB Enterprises
System Solutions and Integration

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: