Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans MalwareMan-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware
Using no malware or stolen passwords, new attack can compromise your cloud synch services and make your good files malicious.
August 5, 2015
BLACK HAT USA -- Las Vegas -- Using no malware or stolen credentials, attackers could obtain complete access to a user's Google Drive or DropBox account, steal data, and corrupt legitimate files with malicious code to infect target users. It's called a man-in-the-cloud attack, and is undetectable by both perimeter and endpoint security tools.
Researchers at Imperva here today released details about the attack. Attackers can compromise cloud file synch services -- like Google Drive, DropBox, OneDrive, and Box -- but not through the front door (by, say, stealing a user's account credentials) or through the back door (by compromising the server), but rather through a side hatch: the user's endpoint machine.
To synch files between the endpoint and the cloud, the service first makes the user authenticate, then hands them a synchronization token and stores it on the endpoint. The token can be used on multiple machines.
So all the man-in-the-cloud attacker needs to do is steal a copy of that synchronization token. And as Imperva has discovered, they can do that by convincing the user to run some very typical code that won't raise any red flags. Instead of using noisy malware, they just make a few basic, and temporary, configuration changes.
The deed is done via a tool Imperva has developed called Switcher. The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker. The victim's machine will instead sync with the attacker's account, so that a copy of the synchronization token for the victim's legitimate account will be stored in the attacker's account. From then on, the two are synched. The process takes only seconds.
Then all the attacker needs to do to hide their tracks is switch it all back. They delete their own synchronization token from the registry, put the user's token back where it belongs, and only a careful look at log files would show any anomalies.
The obvious use cases are cyberespionage or stealing databases of PII to sell, but Imperva CTO Amichai Shulman can see man-in-the-cloud attacks being taken further.
"If we wanted to be even stealthier we could do something worse," says Shulman. "Because files are being synched, we could see which files are being accessed most often, we could take those files, and embed [malicious] code into them," then restore the originals once the infected versions had a chance to deliver their payload.
He also says that if stealth was not a priority, the attackers could threaten doxing and use this for extortion.
"I think the worst part of it," Shulman says, "is if for some reason you detect the compromise, there is nothing you can do but lose the account."
Another reason Shulman thinks the technique will be attractive to criminals is that they get a powerful command-and-control infrastructure without having to build or maintain it themselves. "It's going to be cheaper and it's more robust," he says. It's also less likely to be the target of a law enforcement takedown.
"No one is going to take down Google Drive," he says.
Shulman doesn't think this will make organizations stop using the cloud, nor does he think that encrypting every piece of data before you upload it is the answer. However, he does think that they need to readjust their security programs and budgets.
"Organizations are now moving some of the applications to the cloud; now they need to move some of their security to the cloud ... and once you do that, you regain some visibility into your security."
Read more about:Black Hat News
About the Author(s)
Tricks to Boost Your Threat Hunting GameNov 06, 2023
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
Everything You Need to Know About DNS Attacks
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks
How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Gone Phishing: How to Defend Against Persistent Phishing Attempts Targeting Your Organization
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report
Build a Case for a Password Manager