Can DropSmack malware be stopped? Michael P. Kassner asks the creators of BoxCryptor if it is up to the task of securing the Dropbox file-synchronization service.
I recently wrote about DropSmack; a potentially potent bad-guy tool that manipulates Dropbox's file-synchronization service in order to receive unauthorized command and control traffic from outside a network's perimeter. DropSmack is the creation of Jake Williams (@MalwareJake). In Jake's hands, it is a benevolent, helpful tool used to probe weak spots in a client's network.
But in the wrong hands, Jake quickly pointed out, either DropSmack or a similar software tool is an efficient way to gain a foot hold in highly-fortified corporate networks that knowingly or unknowingly employ a file-synchronization service.
That article stands out to me because it was one of the few times I was unable to offer a solution other than not use the application.
Ray of hope
As I responded to forum comments about DropSmack, I came across one titled, "This is why BoxCryptor is Available!" The member then offered a few thoughts as to how BoxCryptor might stymie DropSmack.
For some reason, BoxCryptor sounded familiar. After a bit, the fog cleared; TechRepublic ran an article about it back in February. Still, I didn't see how BoxCryptor could defeat DropSmack. With nothing to lose, and a chance to learn about BoxCryptor, I decided to ask the people at BoxCryptor what they thought about DropSmack.
What is BoxCryptor?
I first chatted with Andrea Wittek, CEO and founder of BoxCryptor; she then introduced me to Robert Freudenreich, BoxCryptor cofounder, and CTO. It didn't seem right to start with a question about DropSmack, so I asked Robert to explain BoxCryptor:
BoxCryptor is cloud-optimized encryption software made in Germany. With BoxCryptor, you can encrypt your files before uploading them to Dropbox, Google Drive, SkyDrive, Box, or any other cloud storage provider. BoxCryptor supports Windows, Mac OS X, Android, Windows 8, and iOS.Note: It is important to remember both DropSmack and BoxCryptor work with any of the many file-synchronization services. To keep it simple, I'd like to continue using Dropbox to reference the entire group.
Next, I asked Robert why he felt BoxCryptor was needed:
I'm sure you are aware of the many serious security issues involving member data at various cloud storage providers. If you want to make sure your files are protected, you need BoxCryptor.
Robert then started to explain the intricacies of their encryption process. I quickly interrupted Robert, begging him to give me the "non-geeky" version (Follow this link to the geeky version):
BoxCryptor creates a virtual drive on your computer. When you store a file on the virtual drive, BoxCryptor encrypts the file on the fly, and stores it in your Dropbox folder. If you open a file in the BoxCryptor Drive, it is automatically decrypted. Because the key used for encryption is secured with a password, anybody who wants to decrypt and access the file has to know the correct password.
Andrea and Robert consider BoxCryptor to be "Zero-Knowledge" software. Calling something zero-knowledge seemed odd to me, so I asked Robert what they meant:
Zero-Knowledge software means we as the software developers of BoxCryptor do not have access to your keys or files. BoxCryptor is a true client-side software; both encryption and decryption are handled on your device.
Other encryption applications have made similar claims, and you the readers made it clear, assurances weren't enough, so I asked Robert for proof:
No internet connection is required to use BoxCryptor. This can be verified by monitoring the network activity of the BoxCryptor application (none if automatic update check is disabled). Additionally, the encryption algorithm is compatible to the open-source project EncFS, whose source code can be reviewed.
I was interested in something I read on the BoxCryptor website: individual files were encrypted, not containers (like what TrueCrypt uses). I asked Robert about the difference:
As you mentioned, BoxCryptor encrypts each file individually. Other applications use containers: fixed-size folders or virtual drives that retain all the files to be encrypted.
Next, Robert explained why encrypting individual files was important:
Unfortunately, containers do not play well with cloud storage, because synchronizing containers require a lot of overhead. This means:
- Cloud-storage features like versioning cannot be used.
- Collaboration is impossible.
- Downloading the container on your mobile device will be time consuming.
And since BoxCryptor does not use containers, you can keep (most) features of your cloud storage provider, and use BoxCryptor on mobile devices.
I usually forget to mention the different versions of the application I'm writing about — not this time. There are both free and pay versions of BoxCryptor. The additional features offered by the paid versions of BoxCryptor are:
- Filename encryption: The paid versions not only encrypt the contents of a file, but even the name of the file or folder because sensitive information is often contained in the filename.
- Multiple drives: The free version only has one BoxCryptor Drive. In the paid version you can have multiple drives at the same time (e.g. for different projects)
The next step
There's something exciting going on at BoxCryptor headquarters, but I'm not telling. I promised Robert he could:
It is exciting; we're releasing a new version — BoxCryptor 2.0 — in a few weeks. The current BoxCryptor application is great for individuals. But, businesses are now wanting to use cloud file-synchronization, and the current BoxCryptor software does not meet their needs. For example, exchanging passwords is a no-go for businesses. Additionally, BoxCryptor software was not meeting regulatory requirements.
To meet the additional needs, BoxCryptor 2.0 will:
- Use a combination of RSA (4096 bit) and AES (256 bit) encryption to allow the sharing of individual files with other users and groups without having to share the password.
- Allow policy setting, or a master key to decrypt all files from their employees when necessary.
Although the key server for BoxCryptor 2.0 is at our location, we still have neither knowledge of user passwords nor the ability to decrypt user files.
That's good news, Robert. Now that we understand BoxCryptor, I believe it's time... time to see if the DropBox BoxCryptor tag team can outsmart DropSmack.
And the winner is...I had hoped the answer would be BoxCryptor either stops DropSmack or it doesn’t, but it’s not that simple. So I'll step aside, and let Robert explain where and when BoxCryptor will stop DropSmack:
After having a look at your article and the original slides for DropSmack, I came to the conclusion that BoxCryptor can be a deterrent for DropSmack in specific circumstances, but it is not a solution for the attack described.
BoxCryptor will not deter DropSmack:
- If victims use BoxCryptor only for a subset of their Dropbox files. In this case, attackers can still place files containing DropSmack in the "unencrypted part" of Dropbox and execute their attack.
- Or attackers have full access to the private laptop of the victim. When BoxCryptor is running on a machine, the encrypted files are exposed in plaintext in a virtual drive. In general, if attackers have full access to a computer, the victims have lost.
BoxCryptor will deter DropSmack:
- If victims use BoxCryptor for all Dropbox files. They never work with unencrypted files in their Dropbox, but instead use the BoxCryptor virtual drive, meaning all files are automatically encrypted and decrypted.
- If attackers do not have access to any of the victims' computers with BoxCryptor running nor the BoxCryptor password, they are:
- Unable to decrypt any of the existing files and gain information from them.
- Unable to create encrypted versions of the file containing DropSmack. BoxCryptor only allows valid encrypted files in the virtual BoxCryptor drive.
If attackers get full (typically, remote) access to victims' computers or devices, it's difficult to further defend from this attack. BoxCryptor was not designed to prevent attacks where the victims' computers are compromised. BoxCryptor secures data against attackers attempting to access the data after it leaves your computer (employees of storage providers, attackers who hack the storage providers, etc.).
There you have it. I'd give the edge to DropSmack. Still, BoxCryptor will make life a great deal more difficult for the bad guys at the computer level, and when your personal information is in transit. The obvious thing is to make sure your computers aren’t vulnerable (up-to-date, patch-wise), keeping the bad guys from getting that initial toehold on your computer.
I’d like to thank Andrea, Robert, and the team at BoxCryptor for their efforts at making the digital world more secure.