← Back to context

Comment by 0x0

10 years ago

What the fuck Dropbox!

How do I get rid of the backdoor in /Library/Application\ Support/com.apple.TCC/TCC.db even after uninstalling Dropbox.app and rm -rf'ing ~/.dropbox and /Library/DropboxHelperTools? Do I just sudo sqlite3 and delete the row? Or is there an official tool (tccutil)?

Edit: Crap, there's a /Library/Extensions/Dropbox.kext too now. :(

10 comments

0x0

Reply
ddp  10 years ago

I did this:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db

sqlite> delete from "access" where (service=="kTCCServiceAccessibility" and client=="com.getdropbox.dropbox");

...and it seems to have done the trick.

ptomato  10 years ago

should be able to just uncheck Dropbox.app in SysPrefs -> Security & Privacy -> Privacy -> Accessibility

  • 0x0  10 years ago

    It's not visible there, probably because I obliterated the Dropbox.app file.

    Currently rm -rf'ing the kext after kextunloading it and seeing the kextcache rebuilding.

    Why should I trust a company that gets its customer database leaked with a kext that they install via shady deceiving permission dialogs?!

    Uninstalled. Good riddance.

  • hughw  10 years ago

    No, that works only until your next reboot. DB has installed an agent that resets that setting in TCC.db a few seconds after you log in next.

chmaynard  10 years ago

> Crap, there's a /Library/Extensions/Dropbox.kext too

Now I'm getting paranoid. My /Library/Extensions/ directory contains the following kernel extensions. I purchased Little Snitch so I knew about theirs. Anyone have any comments on the rest of them?

  ACS6x.kext
  ATTOCelerityFC8.kext
  ATTOExpressSASHBA2.kext
  ATTOExpressSASRAID2.kext
  ArcMSR.kext
  BJUSBLoad.kext
  CIJUSBLoad.kext
  CalDigitHDProDrv.kext
  HighPointIOP.kext
  HighPointRR.kext
  LittleSnitch.kext
  PromiseSTEX.kext
  SoftRAID.kext

  • citruspi  10 years ago

    I've got all of them except for

      BJUSBLoad.kext
  CIJUSBLoad.kext
  LittleSnitch.kext

    From some online searching, it looks like

        BJUSBLoad.kext

    and

        CIJUSBLoad.kext

    are related to Canon printers.

  • 0x0  10 years ago

    I have all of those except "BJUSBLoad", "CIJUSBLoad" and "LittleSnitch".