Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware

BLACK HAT USA -- Las Vegas -- Using no malware or stolen credentials, attackers could obtain complete access to a user's Google Drive or DropBox account, steal data, and corrupt legitimate files with malicious code to infect target users. It's called a man-in-the-cloud attack, and is undetectable by both perimeter and endpoint security tools.

Researchers at Imperva here today released details about the attack. Attackers can compromise cloud file synch services -- like Google Drive, DropBox, OneDrive, and Box -- but not through the front door (by, say, stealing a user's account credentials) or through the back door (by compromising the server), but rather through a side hatch: the user's endpoint machine.

To synch files between the endpoint and the cloud, the service first makes the user authenticate, then hands them a synchronization token and stores it on the endpoint. The token can be used on multiple machines.

So all the man-in-the-cloud attacker needs to do is steal a copy of that synchronization token. And as Imperva has discovered, they can do that by convincing the user to run some very typical code that won't raise any red flags. Instead of using noisy malware, they just make a few basic, and temporary, configuration changes.

The deed is done via a tool Imperva has developed called Switcher. The attacker social-engineers the victim into running this simple code that will install a new synchronization token -- one for a cloud account owned by the attacker. The victim's machine will instead sync with the attacker's account, so that a copy of the synchronization token for the victim's legitimate account will be stored in the attacker's account. From then on, the two are synched. The process takes only seconds.

Then all the attacker needs to do to hide their tracks is switch it all back. They delete their own synchronization token from the registry, put the user's token back where it belongs, and only a careful look at log files would show any anomalies.

The obvious use cases are cyberespionage or stealing databases of PII to sell, but Imperva CTO Amichai Shulman can see man-in-the-cloud attacks being taken further.

"If we wanted to be even stealthier we could do something worse," says Shulman. "Because files are being synched, we could see which files are being accessed most often, we could take those files, and embed [malicious] code into them," then restore the originals once the infected versions had a chance to deliver their payload.

He also says that if stealth was not a priority, the attackers could threaten doxing and use this for extortion.

"I think the worst part of it," Shulman says, "is if for some reason you detect the compromise, there is nothing you can do but lose the account."

Another reason Shulman thinks the technique will be attractive to criminals is that they get a powerful command-and-control infrastructure without having to build or maintain it themselves. "It's going to be cheaper and it's more robust," he says. It's also less likely to be the target of a law enforcement takedown.

"No one is going to take down Google Drive," he says.

Shulman doesn't think this will make organizations stop using the cloud, nor does he think that encrypting every piece of data before you upload it is the answer. However, he does think that they need to readjust their security programs and budgets.

"Organizations are now moving some of the applications to the cloud; now they need to move some of their security to the cloud ... and once you do that, you regain some visibility into your security."