Looking inside the (Drop) box: researchers reverse-engineer the client and bypass 2FA
August 2013
At USENIX WOOT 2013, Dhiru Kholia and Przemyslaw Wegrzyn unpacked and decompiled Dropbox's obfuscated-Python desktop client, demonstrated SSL interception via code injection, and described a way to hijack accounts and bypass two-factor authentication.
What happened
Dhiru Kholia (Openwall) and Przemyslaw Wegrzyn (CodePainters) presented 'Looking inside the (Drop) box' at the USENIX Workshop on Offensive Technologies (WOOT) in August 2013. They detailed generic techniques to unpack, decrypt and decompile 'frozen' Python applications — using Dropbox's heavily obfuscated client as the case study — effectively opening the client to outside scrutiny for the first time. As Threatpost — 'Researchers Reverse Engineer Dropbox Client' put it, the pair had gone about 'reverse engineering the encryption protecting the client in order to open it up to further security analysis,' recovering the client's internal API and decompiling its source for examination even though 'previous work exists in this field,' applicable 'only to older versions of Dropbox,' since patched.
Beyond the reverse-engineering methods, the paper showed how code-injection could be used to intercept Dropbox's SSL traffic and described a technique to hijack a Dropbox account and bypass its two-factor authentication. Threatpost reported the pair 'managed to demonstrate how to use code-injection techniques to intercept SSL data, essentially hijacking Dropbox communication, as well as bypass two-factor authentication used to protect accounts,' using 'Reflective DLL injection and LD_PRELOAD on Windows and Linux respectively to intercept SSL traffic.' In the researchers' own words: 'Once we are able to execute arbitrary code in Dropbox client context, we patch all SSL objects and are able to snoop on the data before it has been encrypted (on sending side) and after it has been decrypted (on receiving side). This is how we intercept SSL data.' They also found that two-factor authentication 'isn't supported on the client and the client can be accessed with a value known as host_ID, which they were able to gain' — so once that value was obtained, the second factor protecting the web account could be sidestepped entirely.
The authors framed their goal as research transparency: 'We believe that our biggest contribution is to open up the Dropbox platform to further security analysis and research. Dropbox will/should no longer be a black box.' Kholia was blunt about the paper's scope when he told Threatpost: 'Reversing Dropbox is the main focus of our paper. The attacks are just side-effects.'
Impact
The work demonstrated that obfuscation is not security and that a client built on interpreted, packed Python could be fully recovered by determined researchers — exposing how the desktop application authenticated and handled tokens. It enabled independent auditing of Dropbox's client and stands as an early academic data point in arguments that Dropbox's protections could be peeled back rather than trusted as opaque.