Cloud

8/5/2015
07:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware

Using no malware or stolen passwords, new attack can compromise your cloud synch services and make your good files malicious.

BLACK HAT USA -- Las Vegas -- Using no malware or stolen credentials, attackers could obtain complete access to a user's Google Drive or DropBox account, steal data, and corrupt legitimate files with malicious code to infect target users. It's called a man-in-the-cloud attack, and is undetectable by both perimeter and endpoint security tools.

Researchers at Imperva here today released details about the attack. Attackers can compromise cloud file synch services -- like Google Drive, DropBox, OneDrive, and Box -- but not through the front door (by, say, stealing a user's account credentials) or through the back door (by compromising the server), but rather through a side hatch: the user's endpoint machine.

To synch files between the endpoint and the cloud, the service first makes the user authenticate, then hands them a synchronization token and stores it on the endpoint. The token can be used on multiple machines.

So all the man-in-the-cloud attacker needs to do is steal a copy of that synchronization token. And as Imperva has discovered, they can do that by convincing the user to run some very typical code that won't raise any red flags. Instead of using noisy malware, they just make a few basic, and temporary, configuration changes.

The deed is done via a tool Imperva has developed called Switcher. The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker. The victim's machine will instead sync with the attacker's account, so that a copy of the synchronization token for the victim's legitimate account will be stored in the attacker's account. From then on, the two are synched. The process takes only seconds.

Then all the attacker needs to do to hide their tracks is switch it all back. They delete their own synchronization token from the registry, put the user's token back where it belongs, and only a careful look at log files would show any anomalies.

The obvious use cases are cyberespionage or stealing databases of PII to sell, but Imperva CTO Amichai Shulman can see man-in-the-cloud attacks being taken further.

"If we wanted to be even stealthier we could do something worse," says Shulman. "Because files are being synched, we could see which files are being accessed most often, we could take those files, and embed [malicious] code into them," then restore the originals once the infected versions had a chance to deliver their payload.

He also says that if stealth was not a priority, the attackers could threaten doxing and use this for extortion.

"I think the worst part of it," Shulman says, "is if for some reason you detect the compromise, there is nothing you can do but lose the account."

Another reason Shulman thinks the technique will be attractive to criminals is that they get a powerful command-and-control infrastructure without having to build or maintain it themselves. "It's going to be cheaper and it's more robust," he says. It's also less likely to be the target of a law enforcement takedown.

"No one is going to take down Google Drive," he says.

Shulman doesn't think this will make organizations stop using the cloud, nor does he think that encrypting every piece of data before you upload it is the answer. However, he does think that they need to readjust their security programs and budgets.

"Organizations are now moving some of the applications to the cloud; now they need to move some of their security to the cloud ... and once you do that, you regain some visibility into your security."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
8/14/2015 | 7:35:32 AM
un-authorized programming
="The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker."

it's still malware -- even if it is only used for a second
macker490
50%
50%
macker490,
User Rank: Ninja
8/14/2015 | 7:22:08 AM
failure to authenticate, --again
="The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker."

the law isn't going to protect you: you have to "CYA".    this means: learn how to authenticate in a digital world,--and start doing it.

you *cannot* authenticate using old ID data such as name, address, Date of Birth, Soc.Sec.Number, Mother's Maident Name,   etc: these data are stolen and used to impersonate you.

you need a means whereby you can authenticate and still retain exclusive control over your means to do that.   this is what public key encryption is all about.    learn to use it or continue to suffer.   it's up to you .
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/5/2015 | 11:23:52 AM
"Passing Tokens"
Similar to pass the hash, token passing is quite effective. Especially, when the medium is cloud services providing an extra layer of between law enforcement and attacker.
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Get Serious about IoT Security
Derek Manky, Global Security Strategist, Fortinet,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.