Comment by tomku
10 years ago
Non-clickbait title: "How Dropbox uses the root access that you give it during installation to give itself Accessibility authorization without triggering the usual popup".
10 years ago
Non-clickbait title: "How Dropbox uses the root access that you give it during installation to give itself Accessibility authorization without triggering the usual popup".
Great summary. But it's still some kind of hack.
If every app I installed did this then my mac is closer to getting hacked.
Anyway, Apps that asks for root password on installation always makes me cringe, e.g. they could turn on SSH and put a pubkey into authorized_keys, or they could upload SSH identity files. But I still proceed to enter my password.
> Anyway, Apps that asks for root password on installation always makes me cringe, e.g. they could turn on SSH and put a pubkey into authorized_keys, or they could upload SSH identity files. But I still proceed to enter my password.
You don't need root to do any of those things. If you're going to run the SSH server on port 22, sure, but it can be run on any port above 1024 by a regular user in user space.
If you're already running an SSH server, a non-root app can most likely edit your ~/.ssh/authorized_key file. It's just a regular file, nothing special about a malicious app adding an entry to it.
Think a NAT is going to save you? A malicious program can SSH out and create a reverse tunnel to circumvent it.
Short answer: running anything you don't know or trust is dangerous, root access just makes it more dangerous.
>If you're already running an SSH server, a non-root app can most likely edit your ~/.ssh/authorized_key file. It's just a regular file, nothing special about a malicious app adding an entry to it.
That file is -rw-r--r--, so only the owner or root can change it, unless I am misunderstanding you?
2 replies →
How's that any different compared to Linux? AFAIK apt packages can run arbitrary scripts as root.
It's slightly different, because Dropbox board members support warrantless surveillance: http://www.drop-dropbox.com/
2 replies →
There's a world of difference, as long as you are using only default repositories (which you should). Apt itself is root, of course, but it is (or should be) trustworthy. All other apps never see root access unless they need it - and if it is needed, then the package maintainer has checked the package to make sure it only uses root when necessary. Kind of like Apple checking apps on AppStore.
No respectable package would put up a fake sudo prompt only to stash away your password for later use.
4 replies →
Linux packages come from the distribution and are controlled by the distribution, not some random 3rd party business.
"Accessibility authorization" sounds benign, but the "authorization" it gives itself is full control of the Mac via the Accessibility API.
So, "How Dropbox uses the root access you give it during installation to gain full control of your Mac without triggering the usual popup."
Corrected proposed non-clickbait title: "How Dropbox fakes an authorization prompt to trick you into entering credentials that it then caches in order to bypass restrictions on what root is able to do so that it can persist a security bypass mechanism."
The first bit, for me, is key.
It doesn't do that. It doesn't cache the credentials. It doesn't even see your password.
How is it adding itself back to the list after being removed, then?
(Not disbelieving you at all, I just haven't understood this part.)
3 replies →
Not exactly. If you remove dropbox from the accessibility auth list while the client is still running (without removing /Library/DropboxHelperTools) it just adds itself back in. Also it prompts for the password after installation.
So it's more like "how dropbox uses the root access you give it after installation to install software which will permanently re-add itself to accessibility even if you attempt remove its authorization".
That skips the important point that it's not supposed to be possible for even root to do this without a prompt.
No, it's not that the point. The point is that they somehow store your sudo password to set again the accessibility permission at every login. I honestly don't see why the title should be considered a click-bait, it looks pretty much very accurate to me.
Lots of people getting mad at Dropbox for this, which is fine, but should we not also get mad at Apple for making their "security" system so easy to circumvent?
Being an app developer that was bitten in the ass by the new "security" in El Crapitan, and having spent 2 weeks trying to get our app back to normal, this makes me really mad that Apple makes us developers jump through all these hoops for security that isn't actually secure anyway.