Tag Archives: Dropbox

Opening and previewing documents within the browser

 

This is a follow-up to the previous post, “Dropbox…opening my docs?

As it turns out, Dropbox views/opens certain file types in order to convert them to a compatible format so they are easily accessible via web browser for its users.  This makes sense and is common practice for many cloud storage services to provide the convenience of browser access while not needing any additional software to open these documents.

So at first, I was under the impression that only Dropbox had opened the HoneyDocs files.  Now I realize the possibility that any cloud storage service (which provides thumbnail previews or allows access to certain types of documents within a browser) may also need to open these files and copy/index some of the content within.  The other services could have been possibly blocking the external resources from being loaded within the documents that included the embedded links or disregarding them altogether.  This turned out to be a theoretical security issue that Andrew Bortz (Security Team Lead at Dropbox) decided to address, as mentioned in this Hacker News thread.  

Some additional privacy concerns are addressed here, “Three Reasons Why Dropbox Previews Are Security & Privacy Nightmares.”  One suggestion that came up was to grant users the ability to disable this ‘preview’ functionality.  That seems like a reasonable request, especially for users who exclusively use the desktop client and do not have much use for browser specific features on their accounts.

Because of all the official responses and statements, I certainly have a better understanding of the “effects of rendering low-quality previews.”  I still plan on using Dropbox because it does certainly provide benefits, but I will also be more aware of what goes on in the background regarding server-side processes.  With that said, I would recommend looking into Boxcryptor or TrueCrypt if privacy takes precedence over convenience in your situation.

 

 

Dropbox…opening my docs?

 

I had the opportunity recently to beta-test HoneyDocs, a web app that generates documents that can ‘buzz home.’ This is done by a unique, embedded GET request that is initiated when the generated document has been opened.

Several use cases came to mind, but I was most interested in seeing if my cloud storage services were manipulating my files in a way that I may not have been aware of.

My experience:

Uploaded Documents to Dropbox Personal Account with Private Folders (not shared)

  • Uploaded “passwords” documents generated by HoneyDocs.
  • These were uploaded with both the client application as well as the web interface.

dbox1What’s this?  A ‘Buzz’ from the recently uploaded documents?

  • The first successful ‘buzz’ took approximately 10 minutes.
  • I attempted to re-create this by deleting the files in question and re-uploading the same HoneyDocs files, but was unable to get further ‘buzz backs’ with the same files.
  • The IP appears to be an Amazon EC-2 instance in Seattle

dbox2

So now I’m curious…are the files being accessed for de-duplication purposes or possibly malware scanning?  If so, then why are the other file types not being opened?  It appears that only .doc files are being opened…

I then uploaded more HoneyDocs files to my Dropbox folder, this time from a different computer and ISP to rule out any of those variables.

All .doc embedded HoneyDocs appear to have been accessed…from different Amazon EC-2 instance IPs.

dbox3

Further digging into the HoneyDocs data reveals a suspicious User Agent, LibreOffice.  Now I’m curious if this is still an automated process or one that involves human interaction? [Update: As better explained here, this is certainly automated and not as suspicious]

dbox4

 All in all, I made 3 attempts to upload embedded documents and all appeared to be opened from different Amazon instances.  This could have something to do with how Dropbox’s storage architecture is configured while utilizing Amazon S3 buckets.

Regardless, the .doc files seemed to have been opened for some reason.  I’d like to know why…

If you are curious, I encourage you to test it out on your own!  You can sign-up for a free HoneyDocs account here.

[Update:  Please check out the follow-up to this post here]