12/24/2022 0 Comments Sugarsync dropbox skydriveWęgrzyn himself downplayed the significance of this, however, since it was not an actual successful attack on Dropbox and resulted in no data loss. “Basically, if you can reverse-engineer it, you can see how it communicates, see everything about the communication, about what kind of security it is, and what level to attack it.” “I would say it was kind of an easy task-the code was protected in a pretty much simple way,” said Przemysław Węgrzyn, a software engineer at Codepainters, a security firm in Wroclaw, Poland, who co-wrote a paper delivered at the Usenix security conference in Washington, D.C. In a further finding last week, other researchers were able to decrypt the code used by the Dropbox client-the precursor to an attack on Dropbox itself. They really fail at protecting these services.” He discussed his attacks on cloud storage services in a talk at Black Hat earlier this month. Data loss prevention tools have a really hard time with Dropbox and the like. “It’s nearly impossible to detect with current tools, so we don’t know. While no attacks are known to have occurred this way, “I can’t imagine someone somewhere hasn’t been using it for actual attacks,” Williams says. Later, Williams replicated the attack with several other popular cloud-storage synching services. When the CIO next opened that file, the DropSmack tool then allowed malicious commands to be sent inside the corporate network via files synchronized by Dropbox-including commands that allowed files to be stolen. With direct integration with your accounts on Box, Dropbox, Google Drive, MediaFire, OneDrive, SugarSync, CloudMe and ZipShare, WinZip can connect directly. He wrote a malicious file called DropSmack and used it to infect a file already in the CIO’s Dropbox folder. But the crucial next step involved using Dropbox and its synching powers to load a malware file that would then appear in folders inside the corporate network. This by itself wasn’t Dropbox’s fault everything on the machine-passwords, family photos-was exposed. When the CIO was away from the office with his laptop, Williams was able to get access to the computer-and found corporate documents in a Dropbox synchronization folder. As a first step, unrelated to Dropbox, Williams obtained a personal e-mail address for the CIO and successfully carried out a “spear-phishing” attack when the CIO clicked on an attached file containing malware. Williams stumbled onto exploiting Dropbox as an attack vector when a client asked him to test the security of a corporate network. Dropbox just facilitated a channel for documents through the corporate firewall.” He called it “a well-put-together combination of existing exploits.” “The attack here is not in fact on Dropbox but rather in the people’s use of Dropbox. “With the increasing use of cloud-based services, these kinds of attacks are going to reappear until the platforms mature,” says Radu Sion, a computer scientist and security reasearcher at Stony Brook University. While such services can be better than running everything yourself (see “ Being Smart about Cloud Security”), security researchers keep finding new ways to attack them (see “ Security Researchers Rain on Amazon’s Cloud”). The research on Dropbox and similar services adds to a litany of recent security concerns over storing data and doing computation on remote or “cloud” servers.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |