Dropbox Addresses Security Concerns for New Initiative’s Kernel Access

Dropbox has responded to security concerns regarding one of its new technology’s abilities to obtain kernel access.

Back in April, the secure file sharing and storage service announced “Project Infinite,” an initiative which will help revolutionize the way Dropbox interfaces with a user’s computer.

Dropbox software engineer Damien Deville provides more information in a blog post.

“Traditionally, Dropbox operated entirely in user space as a program just like any other on your machine. With Dropbox Infinite, we’re going… into the kernel—the core of the operating system. [We’re] evolving from a process that passively watches what happens on your local disk to one that actively plays a role in your filesystem.”

Dropbox currently overlays a green check icon on all files that are available locally. Project Infinite will add a cloud icon as a second overlay that indicates a file is available online but not yet locally. Users can therefore download that file and interact with it as they would any other file.

To view a video of how this new initiative works, please click here.

Dropbox designed Project Infinite to grant users access to all of their saved files regardless of how much space they have available locally on their hard drives.

While this explanation might appeal to end users, Sam Bowne, who teaches Ethical Hacking at City College San Francisco, is worried about the level of access the new initiative would require. Per Bowne’s conversation with Motherboard:

“By moving from userland to kernel-land, Dropbox will take on a large responsibility. The way Dropbox works now, it’s like a vendor setting up a cart outside your home selling hot dogs. But they are now proposing to copy the keys to your house, move in, and live with you.”

Bowne and other security experts are worried that if flaws existed in Project Initiative, attackers could use those vulnerabilities to escalate their access and assume control of a user’s computer.

@iblametom @josephfcox disgustingly insecure software with highest possible privileges examining all your files? Seems safe.

— Bobby 'Tables (@info_dox) May 25, 2016

In light of these concerns, Deville has released the following update from Dropbox:

“We wanted to address some comments about Project Infinite and the kernel. It’s important to understand that many pieces of everyday software load components in the kernel, from simple device drivers for your mouse to highly complex anti-virus programs. We approach the kernel with extreme caution and respect. Because the kernel connects applications to the physical memory, CPU, and external devices, any bug introduced to the kernel can adversely affect the whole machine. We’ve been running this kernel extension internally at Dropbox for almost a year and have battle-tested its stability and integrity.