Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/5/2015
07:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware

Using no malware or stolen passwords, new attack can compromise your cloud synch services and make your good files malicious.

BLACK HAT USA -- Las Vegas -- Using no malware or stolen credentials, attackers could obtain complete access to a user's Google Drive or DropBox account, steal data, and corrupt legitimate files with malicious code to infect target users. It's called a man-in-the-cloud attack, and is undetectable by both perimeter and endpoint security tools.

Researchers at Imperva here today released details about the attack. Attackers can compromise cloud file synch services -- like Google Drive, DropBox, OneDrive, and Box -- but not through the front door (by, say, stealing a user's account credentials) or through the back door (by compromising the server), but rather through a side hatch: the user's endpoint machine.

To synch files between the endpoint and the cloud, the service first makes the user authenticate, then hands them a synchronization token and stores it on the endpoint. The token can be used on multiple machines.

So all the man-in-the-cloud attacker needs to do is steal a copy of that synchronization token. And as Imperva has discovered, they can do that by convincing the user to run some very typical code that won't raise any red flags. Instead of using noisy malware, they just make a few basic, and temporary, configuration changes.

The deed is done via a tool Imperva has developed called Switcher. The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker. The victim's machine will instead sync with the attacker's account, so that a copy of the synchronization token for the victim's legitimate account will be stored in the attacker's account. From then on, the two are synched. The process takes only seconds.

Then all the attacker needs to do to hide their tracks is switch it all back. They delete their own synchronization token from the registry, put the user's token back where it belongs, and only a careful look at log files would show any anomalies.

The obvious use cases are cyberespionage or stealing databases of PII to sell, but Imperva CTO Amichai Shulman can see man-in-the-cloud attacks being taken further.

"If we wanted to be even stealthier we could do something worse," says Shulman. "Because files are being synched, we could see which files are being accessed most often, we could take those files, and embed [malicious] code into them," then restore the originals once the infected versions had a chance to deliver their payload.

He also says that if stealth was not a priority, the attackers could threaten doxing and use this for extortion.

"I think the worst part of it," Shulman says, "is if for some reason you detect the compromise, there is nothing you can do but lose the account."

Another reason Shulman thinks the technique will be attractive to criminals is that they get a powerful command-and-control infrastructure without having to build or maintain it themselves. "It's going to be cheaper and it's more robust," he says. It's also less likely to be the target of a law enforcement takedown.

"No one is going to take down Google Drive," he says.

Shulman doesn't think this will make organizations stop using the cloud, nor does he think that encrypting every piece of data before you upload it is the answer. However, he does think that they need to readjust their security programs and budgets.

"Organizations are now moving some of the applications to the cloud; now they need to move some of their security to the cloud ... and once you do that, you regain some visibility into your security."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/5/2015 | 11:23:52 AM
"Passing Tokens"
Similar to pass the hash, token passing is quite effective. Especially, when the medium is cloud services providing an extra layer of between law enforcement and attacker.
macker490
50%
50%
macker490,
User Rank: Ninja
8/14/2015 | 7:22:08 AM
failure to authenticate, --again
="The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker."

the law isn't going to protect you: you have to "CYA".    this means: learn how to authenticate in a digital world,--and start doing it.

you *cannot* authenticate using old ID data such as name, address, Date of Birth, Soc.Sec.Number, Mother's Maident Name,   etc: these data are stolen and used to impersonate you.

you need a means whereby you can authenticate and still retain exclusive control over your means to do that.   this is what public key encryption is all about.    learn to use it or continue to suffer.   it's up to you .
macker490
50%
50%
macker490,
User Rank: Ninja
8/14/2015 | 7:35:32 AM
un-authorized programming
="The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker."

it's still malware -- even if it is only used for a second
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27569
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name in a crafted packet. This information is sent in cleartext and is not protected by any authentication logic.
CVE-2021-27570
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the process name in a specially crafted packet. This information is sent in cleartext and is not protected by any authentication logic.
CVE-2021-27571
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applications, their icons, and their file paths. This information is sent in cleartext and is not protected by any authentication logic.
CVE-2021-27572
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Authentication Bypass can occur via Packet Replay. Remote unauthenticated users can execute arbitrary code via crafted UDP packets even when passwords are set.
CVE-2021-27573
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Remote unauthenticated users can execute arbitrary code via crafted UDP packets with no prior authorization or authentication.