DropSmack: turning Dropbox into a malware and data-theft channel

Security researcher Jake Williams, of CSR Group, presented 'DropSmack: How cloud synchronization services render your corporate firewall worthless' at Black Hat Europe in Amsterdam in March 2013. DropSmack was a proof-of-concept tool that used the Dropbox sync folder itself as a command-and-control channel for malware planted on a corporate laptop, supporting a command set that Williams's write-up lists as PUT, GET, DELETE, EXECUTE, SLEEP and MOVE (presented in the source as a bulleted list, not a quoted sentence)

According to a write-up of the briefing, Williams's scenario began from a target whose "corporate data were stored on the laptop, and synchronized into the cloud using Dropbox." The implant was delivered by embedding a macro payload inside a file the victim already had synced, so the victim opened a document they recognized rather than an obvious attachment; once running, it watched the same synced folder for operator instructions and used the identical sync channel to carry stolen files back out from behind the corporate firewall.

DropSmack was a demonstration of how any always-on sync service can defeat perimeter and data-loss-prevention controls once an endpoint is already compromised, not a vulnerability in Dropbox's own code or infrastructure; the write-up records no statement or response from Dropbox on the technique. The mitigations discussed at the briefing were application whitelisting, scanning user profiles for unsanctioned sync clients, monitoring the Dropbox LanSync protocol on the local network, and setting an explicit policy on whether sync services are permitted on corporate machines at all — since SSL-encrypted sync traffic is otherwise hard to distinguish from legitimate use and routinely bypasses DLP tooling.