DropBox Gains Root Privilege of Your Mac Through Hack

[CrickettGrrrl]

I'm surprised not to see this posted on MacRumors somewhere. Here are links to how DropBox is doing it, what one can do to mitigate it, etc.:

http://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/#comment-27348

http://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/

http://www.loopinsight.com/2016/09/...tter&utm_campaign=twitter&utm_medium=referral

 

[Pakaku]

Must be a recent thing or requires actually running Dropbox. I ditched it for Mega and there's nothing in my Privacy tab about anything like this.

 

[KALLT]

It was posted a while back. I suspect that Dropbox uses this hack to re-enable the extension and add the Dropbox icon to the Finder toolbar and sidebar. In other words, pure convenience in exchange for security.

 

[CrickettGrrrl]

It's essentially a large back door into a Mac.

Deleting the /Library/DropboxHelperTools files and removing DB from the Security & Privacy/Accessibility apps list still allows Dropbox to function as one would expect. What's very troubling is DB's less than ethical sql hacks to gain root privilege & their spoofed password request box.

 

[Cole Slaw]

I don't like this, so I got rid of DropBox altogether.
Sneaky.

 

[WilliamG]

I'm surprised not to see this posted on MacRumors somewhere. Here are links to how DropBox is doing it, what one can do to mitigate it, etc.:

http://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/#comment-27348

http://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/

http://www.loopinsight.com/2016/09/...tter&utm_campaign=twitter&utm_medium=referral

View attachment 650222

To be fair, for some reason Smashtunes, MacID, Steam and Diablo 3 also had check marks enabled in my Accessibility settings. Wassup with that?

 

[KALLT]

To be fair, for some reason Smashtunes, MacID, Steam and Diablo 3 also had check marks enabled in my Accessibility settings. Wassup with that?

If you don’t know, then you should ask the developers. These apps have effectively the same controls as you have using keyboard and mouse/trackpad, among other things. You should try revoking these permissions and see if these programs still work normally. I suspect that MacID legitimately needs this access.

 

[CrickettGrrrl]

I don't like this, so I got rid of DropBox altogether.
Sneaky.

Yes, I followed the steps to remove Dropbox from Accessibility, thought about it for a day or two & read several more articles, then removed Dropbox completely from 3 of my computers. Dropbox is very shady.

 

[OllyW]

Please continue in the Dropbox Responds to Mac 'Security Risk' Accusations news discussion thread.