Can You Brute Force Dropbox Folder URLs?

Question

One can share folders with Dropbox by sending a URL with a hash in it.

A recent article reported that user files were accessed by generating urls from common URL shortners.

These URLs are typically much shorter than the hash url generated by Dropbox.

If you don't password protect the URL there is a non-zero chance that it could be accessed in a random brute force attack on Dropbox.

Would it be statistically possible for someone/botnet to randomly generate the urls and find any content (not necessarily mine). Or are there just too many possibilities available?

EDIT: The news article linked above references a blog post, which in turn references the academic paper.

Answer 1

Can you brute force Dropbox URL? Well, yes, you can also brute force AES256 encrypted file. I think what you are really asking is, would you be successful?

It's quite unlikely. Currently, Dropbox share URL is 11 characters that consists of lowercase alphabets and numbers (36 possible characters). This gives a key space of 36**11 ≈ 1.31621704 × 10^17 possible keys or ln(36**11) / ln(2) ≈ 56.869175 bits.

Now this boils down to a math problem: suppose that there are m occupied keys in a key space of 36**11, if an attacker sends n guesses, what is the probability that at least one of the guesses matches an occupied key.

How many files are in Dropbox that have share URL? I don't think Dropbox published this data, so I'm going to make a guess. Let's say there's 1 billion files with share URL.

If the attacker makes a single guess, he has a 1000000000/36**11 = 7.59753119 × 10**-9 = chance of guessing one key in one guess.

Suppose that the entire Dropbox security response team is on holiday and the attacker managed to make 1 million guesses before Dropbox noticed something's up and shut the attacker down. Then the chance that at least one of the million guesses matches an existing document is 1-(1-1000000000/36**11)**1000000 = 0.00756874289.

Which is about 0.75% chance that the attacker will be able to retrieve a single random file after one million guesses.

In practice though, Dropbox probably have measures to detect and block automated random key requests.

Answer 2

Technically yes it would be possible to attempt a brute-force attack but other controls may prevent the attack from being successful.

The business to customer relationship for a site like DropBox is very different from an URL-shortner which makes it much easier for a site like DropBox to also deploy automated attack countermeasures like blocking or slowing down authentication attempts after X number of failures. So although a brute-force is technically possible it's much less likely that it would be the only security control in place for a site like that which has different security concerns and a different security model.

Note: If the attacker used something like Tor to make many anonymous connections the service provider can "slow" all of the traffic from Tor exit nodes and still allow their business to operate. Likewise the attack tools themselves sometimes have indicators in their requests or request frequency which sometimes make them easier to block if needed.