Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware

Using no malware or stolen passwords, new attack can compromise your cloud synch services and make your good files malicious.

BLACK HAT USA -- Las Vegas -- Using no malware or stolen credentials, attackers could obtain complete access to a users Google Drive or DropBox account, steal data, and corrupt legitimate files with malicious code to infect target users. Its called a man-in-the-cloud attack, and is undetectable by both perimeter and endpoint security tools.
Researchers at Imperva here today released details about the attack. Attackers can compromise cloud file synch services -- like Google Drive, DropBox, OneDrive, and Box -- but not through the front door (by, say, stealing a users account credentials) or through the back door (by compromising the server), but rather through a side hatch: the users endpoint machine.
To synch files between the endpoint and the cloud, the service first makes the user authenticate, then hands them a synchronization token and stores it on the endpoint. The token can be used on multiple machines.
So all the man-in-the-cloud attacker needs to do is steal a copy of that synchronization token. And as Imperva has discovered, they can do that by convincing the user to run some very typical code that wont raise any red flags. Instead of using noisy malware, they just make a few basic, and temporary, configuration changes.
The deed is done via a tool Imperva has developed called Switcher. The attacker social-engineers the victim into running this simple code that will install a
new
synchronization token -- one for a cloud account owned by the attacker. The victims machine will instead sync with the attackers account, so that a copy of the synchronization token for the victims legitimate account will be stored in the attackers account. From then on, the two are synched. The process takes only seconds.
Then all the attacker needs to do to hide their tracks is switch it all back. They delete their own synchronization token from the registry, put the users token back where it belongs, and only a careful look at log files would show any anomalies.
The obvious use cases are cyberespionage or stealing databases of PII to sell, but Imperva CTO Amichai Shulman can see man-in-the-cloud attacks being taken further.
If we wanted to be even stealthier we could do something worse, says Shulman. Because files are being synched, we could see which files are being accessed most often, we could take those files, and embed [malicious] code into them, then restore the originals once the infected versions had a chance to deliver their payload.
He also says that if stealth was not a priority, the attackers could threaten doxing and use this for extortion.
I think the worst part of it, Shulman says, is if for some reason you detect the compromise, there is nothing you can do but lose the account.
Another reason Shulman thinks the technique will be attractive to criminals is that they get a powerful command-and-control infrastructure without having to build or maintain it themselves. Its going to be cheaper and its more robust, he says. Its also less likely to be the target of a law enforcement takedown.
No one is going to take down Google Drive, he says.
Shulman doesnt think this will make organizations stop using the cloud, nor does he think that encrypting every piece of data before you upload it is the answer. However, he does think that they need to readjust their security programs and budgets.
Organizations are now moving some of the applications to the cloud; now they need to move some of their security to the cloud ... and once you do that, you regain some visibility into your security.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware