2

One can share folders with Dropbox by sending a URL with a hash in it.

A recent article reported that user files were accessed by generating urls from common URL shortners.

These URLs are typically much shorter than the hash url generated by Dropbox.

If you don't password protect the URL there is a non-zero chance that it could be accessed in a random brute force attack on Dropbox.

Would it be statistically possible for someone/botnet to randomly generate the urls and find any content (not necessarily mine). Or are there just too many possibilities available?

EDIT: The news article linked above references a blog post, which in turn references the academic paper.

4
  • 2
    Did you read the article and the academic paper it refers to? Its authors claim 18 months of research and give a detailed answer to your question. If yes, then what are you trying to achieve by asking the question here?
    – techraf
    Commented Apr 19, 2016 at 1:22
  • TBH: I hadn't followed the links to the academic paper until you mentioned it was there. However, it focuses on short urls and bit.ly in particular. It doesn't mention Dropbox specifically, whether there is an API for it or the impact/benefit of longer urls.
    – opticyclic
    Commented Apr 19, 2016 at 12:47
  • The very first sentence of paper abstract: "storage providers such as Microsoft OneDrive and mapping services such as Google Maps, directly integrate URL shorteners" and 1/3 of the paper content is in chapters on OneDrive and Google Drive.
    – techraf
    Commented Apr 19, 2016 at 12:53
  • 1
    Exactly. I am not asking about URL shortners. I am asking about DropBox urls specifically.
    – opticyclic
    Commented Apr 20, 2016 at 17:45

2 Answers 2

3

Can you brute force Dropbox URL? Well, yes, you can also brute force AES256 encrypted file. I think what you are really asking is, would you be successful?

It's quite unlikely. Currently, Dropbox share URL is 11 characters that consists of lowercase alphabets and numbers (36 possible characters). This gives a key space of 36**11 ≈ 1.31621704 × 10^17 possible keys or ln(36**11) / ln(2) ≈ 56.869175 bits.

Now this boils down to a math problem: suppose that there are m occupied keys in a key space of 36**11, if an attacker sends n guesses, what is the probability that at least one of the guesses matches an occupied key.

How many files are in Dropbox that have share URL? I don't think Dropbox published this data, so I'm going to make a guess. Let's say there's 1 billion files with share URL.

If the attacker makes a single guess, he has a 1000000000/36**11 = 7.59753119 × 10**-9 = chance of guessing one key in one guess.

Suppose that the entire Dropbox security response team is on holiday and the attacker managed to make 1 million guesses before Dropbox noticed something's up and shut the attacker down. Then the chance that at least one of the million guesses matches an existing document is 1-(1-1000000000/36**11)**1000000 = 0.00756874289.

Which is about 0.75% chance that the attacker will be able to retrieve a single random file after one million guesses.

In practice though, Dropbox probably have measures to detect and block automated random key requests.

1
  • so, if I got a botnet with a million nodes to try once each, I'd have a 0.75% change of getting a hit. And then I could try a few hours later, and again have an 0.75% chance, etc. If attempts could be made every 6 hours without triggering a response, about 4 months would be needed to have a good chance of getting a positive hit. Commented Dec 1, 2017 at 2:54
2

Technically yes it would be possible to attempt a brute-force attack but other controls may prevent the attack from being successful.

The business to customer relationship for a site like DropBox is very different from an URL-shortner which makes it much easier for a site like DropBox to also deploy automated attack countermeasures like blocking or slowing down authentication attempts after X number of failures. So although a brute-force is technically possible it's much less likely that it would be the only security control in place for a site like that which has different security concerns and a different security model.

Note: If the attacker used something like Tor to make many anonymous connections the service provider can "slow" all of the traffic from Tor exit nodes and still allow their business to operate. Likewise the attack tools themselves sometimes have indicators in their requests or request frequency which sometimes make them easier to block if needed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .