Looking inside the (Drop) box
📜 Abstract
Dropbox is a cloud based file storage service used by more than 100 million users. In spite of its widespread popularity, we believe that Dropbox as a platform hasn’t been analyzed extensively enough from a security standpoint. Also, the previous work on the security analysis of Dropbox has been heavily censored. Moreover, the existing Python bytecode reversing techniques are not enough for reversing hardened applications like Dropbox. This paper presents new and generic techniques, to reverse engineer frozen Python applications, which are not limited to just the Dropbox world. We describe a method to bypass Dropbox’s two factor authentication and hijack Dropbox accounts. Additionally, generic techniques to intercept SSL data using code injection techniques and monkey patching are presented. We believe that our biggest contribution is to open up the Dropbox platform to further security analysis and research. Dropbox will / should no longer be a black box. Finally, we describe the design and implementation of an open-source version of Dropbox client (and yes, it runs on ARM too).
✨ Summary
The paper presents a practical methodology for reversing hardened, frozen Python applications. Its approach combines process injection, runtime access to Python objects, custom marshalling, opcode recovery, and decompilation, avoiding the need to recover Dropbox’s changing bytecode-encryption algorithms directly. The authors apply these methods to expose Dropbox’s internal client API, intercept SSL data before encryption or after decryption, demonstrate weaknesses in the client’s authentication design, and implement an open-source-compatible client.
Subsequent work explicitly built on these results. A later Dropbox security paper cited this paper as the basis for extracting the host_id token, analyzing the client’s authentication mechanism, and using reflective DLL injection and LD_PRELOAD; it then extended the analysis to newer Dropbox versions and RAM-based token extraction. (cpp.edu) The paper’s Dropbox analysis was also reused as a concrete industry example in a later presentation on software obfuscation, specifically illustrating ciphered bytecode, opcode permutation, and a modified runtime as anti-reversing techniques. (compil2019.minesparis.psl.eu) USENIX records the work as a WOOT ’13 conference paper published in August 2013. (usenix.org)