{"id":552,"date":"2011-04-28T06:23:20","date_gmt":"2011-04-28T11:23:20","guid":{"rendered":"http:\/\/rud.is\/b\/?p=552"},"modified":"2017-03-27T09:40:05","modified_gmt":"2017-03-27T14:40:05","slug":"dropbox-1-2-0-experimental-build-fixes-security-issue","status":"publish","type":"post","link":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/","title":{"rendered":"Dropbox 1.2.0 Experimental Build “Fixes” Security Issue"},"content":{"rendered":"

If you are concerned about the Dropbox design flaw exposed by the dbClone<\/a> attack, then have we got a link for you!<\/p>\n

The intrepid DB devs have tossed up a forum release<\/span> which purports to fix all the thorny security issues. You can no longer just copy a config file to a separate machine to clone a filesystem and the file itself is now also encrypted. (Forum builds do not automagically download like standard Dropbox updates)<\/p>\n

Given the fact that Dropbox did not prompt me for any credentials when I started the new version, I’m still a bit skeptical that it has truly fixed the problem. Given my schedule today, I doubt I’ll have time to poke at it before someone else does, but the thoroughness of this fix does need to be independently validated. The local Dropbox client has<\/em> to be getting the encryption key\/passphrase from *somewhere*, and if it’s not prompting me on start, then it’s stored online or locally and that’s a recipe for another hack.<\/p>\n

There is nothing overt in the application bundle (looking on OS X) or quickly discernable from a dump of a few of the app’s .pyc<\/code> files. Granted, a bit of obfuscation will stop the current hack and dissuade some other sophomoric attempts, but I can almost guarantee that the passphrase (or the algorithm one needs to discern the passphrase) will be found by folks. <\/p>\n

The new build replaces your local configuration file with a new, encrypted one (now named config.dbx<\/code>). I didn’t see signs of either SQLiteEncrypt<\/a>, SEE<\/a>, SQLCipher<\/a> or SQLiteCrypt<\/a> but haven’t had time to dig more thoroughly. It’s completely possible the Dropbox devs just built an encryption layer over the Dropbox calls themselves (which is not a difficult task).<\/p>\n

Please note<\/strong> that forum builds are not necessarily stable and that this is a pretty major architecture change. I had no issues on OS X, but I suspect that any micro-errors in your SQLite config.db<\/code> may cause some heartache if you do attempt the upgrade. Best to wait for a full production release if you do not have your Dropbox backed up somewhere.<\/p>\n","protected":false},"excerpt":{"rendered":"

If you are concerned about the Dropbox design flaw exposed by the dbClone attack, then have we got a link for you! The intrepid DB devs have tossed up a forum release which purports to fix all the thorny security issues. You can no longer just copy a config file to a separate machine to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[65,70,3],"tags":[130,107,164,419,23,391,131,125,165,418],"class_list":["post-552","post","type-post","status-publish","format-standard","hentry","category-dropbox-2","category-encryption","category-information-security","tag-cloud-storage","tag-computing","tag-data-synchronization","tag-devs","tag-dropbox","tag-encryption-2","tag-file-hosting","tag-mac-os-x","tag-online-backup-services","tag-passphrase"],"yoast_head":"\nDropbox 1.2.0 Experimental Build "Fixes" Security Issue - rud.is<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Dropbox 1.2.0 Experimental Build "Fixes" Security Issue - rud.is\" \/>\n<meta property=\"og:description\" content=\"If you are concerned about the Dropbox design flaw exposed by the dbClone attack, then have we got a link for you! The intrepid DB devs have tossed up a forum release which purports to fix all the thorny security issues. You can no longer just copy a config file to a separate machine to […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/\" \/>\n<meta property=\"og:site_name\" content=\"rud.is\" \/>\n<meta property=\"article:published_time\" content=\"2011-04-28T11:23:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2017-03-27T14:40:05+00:00\" \/>\n<meta name=\"author\" content=\"hrbrmstr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"hrbrmstr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/\"},\"author\":{\"name\":\"hrbrmstr\",\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\"},\"headline\":\"Dropbox 1.2.0 Experimental Build “Fixes” Security Issue\",\"datePublished\":\"2011-04-28T11:23:20+00:00\",\"dateModified\":\"2017-03-27T14:40:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/\"},\"wordCount\":366,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\"},\"keywords\":[\"Cloud storage\",\"Computing\",\"Data synchronization\",\"DEVS\",\"dropbox\",\"encryption\",\"File hosting\",\"Mac OS X\",\"Online backup services\",\"Passphrase\"],\"articleSection\":[\"Dropbox\",\"Encryption\",\"Information Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/\",\"url\":\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/\",\"name\":\"Dropbox 1.2.0 Experimental Build \\\"Fixes\\\" Security Issue - rud.is\",\"isPartOf\":{\"@id\":\"https:\/\/rud.is\/b\/#website\"},\"datePublished\":\"2011-04-28T11:23:20+00:00\",\"dateModified\":\"2017-03-27T14:40:05+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/rud.is\/b\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Dropbox 1.2.0 Experimental Build “Fixes” Security Issue\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/rud.is\/b\/#website\",\"url\":\"https:\/\/rud.is\/b\/\",\"name\":\"rud.is\",\"description\":\""In God we trust. All others must bring data"\",\"publisher\":{\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/rud.is\/b\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\",\"name\":\"hrbrmstr\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\",\"url\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\",\"width\":460,\"height\":460,\"caption\":\"hrbrmstr\"},\"logo\":{\"@id\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\"},\"description\":\"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7\",\"sameAs\":[\"http:\/\/rud.is\"],\"url\":\"https:\/\/rud.is\/b\/author\/hrbrmstr\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Dropbox 1.2.0 Experimental Build \"Fixes\" Security Issue - rud.is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/","og_locale":"en_US","og_type":"article","og_title":"Dropbox 1.2.0 Experimental Build \"Fixes\" Security Issue - rud.is","og_description":"If you are concerned about the Dropbox design flaw exposed by the dbClone attack, then have we got a link for you! The intrepid DB devs have tossed up a forum release which purports to fix all the thorny security issues. You can no longer just copy a config file to a separate machine to […]","og_url":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/","og_site_name":"rud.is","article_published_time":"2011-04-28T11:23:20+00:00","article_modified_time":"2017-03-27T14:40:05+00:00","author":"hrbrmstr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"hrbrmstr","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#article","isPartOf":{"@id":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/"},"author":{"name":"hrbrmstr","@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"headline":"Dropbox 1.2.0 Experimental Build “Fixes” Security Issue","datePublished":"2011-04-28T11:23:20+00:00","dateModified":"2017-03-27T14:40:05+00:00","mainEntityOfPage":{"@id":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/"},"wordCount":366,"commentCount":0,"publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"keywords":["Cloud storage","Computing","Data synchronization","DEVS","dropbox","encryption","File hosting","Mac OS X","Online backup services","Passphrase"],"articleSection":["Dropbox","Encryption","Information Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/","url":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/","name":"Dropbox 1.2.0 Experimental Build \"Fixes\" Security Issue - rud.is","isPartOf":{"@id":"https:\/\/rud.is\/b\/#website"},"datePublished":"2011-04-28T11:23:20+00:00","dateModified":"2017-03-27T14:40:05+00:00","breadcrumb":{"@id":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/rud.is\/b\/2011\/04\/28\/dropbox-1-2-0-experimental-build-fixes-security-issue\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/rud.is\/b\/"},{"@type":"ListItem","position":2,"name":"Dropbox 1.2.0 Experimental Build “Fixes” Security Issue"}]},{"@type":"WebSite","@id":"https:\/\/rud.is\/b\/#website","url":"https:\/\/rud.is\/b\/","name":"rud.is","description":""In God we trust. All others must bring data"","publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rud.is\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886","name":"hrbrmstr","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","width":460,"height":460,"caption":"hrbrmstr"},"logo":{"@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1"},"description":"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7","sameAs":["http:\/\/rud.is"],"url":"https:\/\/rud.is\/b\/author\/hrbrmstr\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p23idr-8U","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":10104,"url":"https:\/\/rud.is\/b\/2018\/04\/18\/access-your-saved-for-later-feedly-items-by-hooking-up-dropbox-to-feedly\/","url_meta":{"origin":552,"position":0},"title":"Access Your “Saved for Later” Feedly Items By Hooking Up Dropbox to Feedly","author":"hrbrmstr","date":"2018-04-18","format":false,"excerpt":"If you come here often you've noticed that I've been writing a semi-frequent series on using the Feedly API with R. A recent post was created to help someone use the API. It worked for them but \u2014 as you can see in the comment \u2014 an assertion was made\u2026","rel":"","context":"In "data wrangling"","block_context":{"text":"data wrangling","link":"https:\/\/rud.is\/b\/category\/data-wrangling\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":512,"url":"https:\/\/rud.is\/b\/2011\/04\/17\/a-fully-operational-os-x-dbclone\/","url_meta":{"origin":552,"position":1},"title":"A Fully Operational OS X dbClone","author":"hrbrmstr","date":"2011-04-17","format":false,"excerpt":"Spent some time today updating the missing bits of the OS X version of the Dropbox cloner I uploaded last night. You can just grab the executable or grab the whole project from the github repository. The app can now backup\/restore of local config, clone dropbox configs to a URL\/file\u2026","rel":"","context":"In "Development"","block_context":{"text":"Development","link":"https:\/\/rud.is\/b\/category\/development\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":485,"url":"https:\/\/rud.is\/b\/2011\/04\/16\/dbclone-hack-for-os-x\/","url_meta":{"origin":552,"position":2},"title":"dbClone “hack” for OS X","author":"hrbrmstr","date":"2011-04-16","format":false,"excerpt":"UPDATE: Check out the newer post on additional features. There has been much ado of late about Dropbox security with one of the most egregious issues being how easy it is to surreptitiously \"clone\" someone else's Dropbox by obtaining just one piece of data - the host id - from\u2026","rel":"","context":"In "Development"","block_context":{"text":"Development","link":"https:\/\/rud.is\/b\/category\/development\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":18,"url":"https:\/\/rud.is\/b\/2011\/02\/02\/backup-workflow\/","url_meta":{"origin":552,"position":3},"title":"Backup Workflow","author":"hrbrmstr","date":"2011-02-02","format":false,"excerpt":"I\u00a0was trying to convey my backup workflow\/setup to @joeday in 140 and it just wasn't working very well. Twitter -\u00a0as one might expect - is not exactly the place for detailed technical discussions, but it does provide fertile ground to spark ideas and dialogue. I told @geekshui that I'd blog\u2026","rel":"","context":"In "Backups"","block_context":{"text":"Backups","link":"https:\/\/rud.is\/b\/category\/backups\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3469,"url":"https:\/\/rud.is\/b\/2015\/06\/19\/do-something-nifffty-with-r\/","url_meta":{"origin":552,"position":4},"title":"DO Something Nifffty with R","author":"hrbrmstr","date":"2015-06-19","format":false,"excerpt":"@briandconnelly (of [pushoverr](http:\/\/crantastic.org\/authors\/4002) fame) made a super-cool post about [connecting R](http:\/\/bconnelly.net\/2015\/06\/connecting-r-to-everything-with-ifttt\/) to @IFTTT via IFTTT's \"Maker\" channel. The IFTTT Maker interface to receive events is fairly straightforward and Brian's code worked flawlessly, so it was easy to tweak a bit and [wrap into a package](https:\/\/github.com\/hrbrmstr\/nifffty). To get started, you can\u2026","rel":"","context":"In "Apple Watch"","block_context":{"text":"Apple Watch","link":"https:\/\/rud.is\/b\/category\/apple-watch\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":81,"url":"https:\/\/rud.is\/b\/2011\/02\/08\/quick-hits-2011-02-08\/","url_meta":{"origin":552,"position":5},"title":"Quick Hits :: 2011-02-08","author":"hrbrmstr","date":"2011-02-08","format":false,"excerpt":"Security Originally meant to improve the security of jailbroken iOS devices, antid0te is now also available for OS X Snow Leopard thanks to the efforts of Stefan Esser. Since Apple engineers did not see fit to load the dynamic linker - dyld - at a random base address, they left\u2026","rel":"","context":"In "Information Security"","block_context":{"text":"Information Security","link":"https:\/\/rud.is\/b\/category\/information-security\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/comments?post=552"}],"version-history":[{"count":0,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/552\/revisions"}],"wp:attachment":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media?parent=552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/categories?post=552"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/tags?post=552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}