Hackers use Dropbox, WordPress to spread malware

The Chinese cyberspies behind the widely publicized espionage campaign against The New York Times have added Dropbox and WordPress to their bag of spear-phishing tricks.

The gang, known in security circles as the DNSCalc gang, has been using the Dropbox file-sharing service for roughly the last 12 months as a mechanism for spreading malware, said Rich Barger, chief intelligence officer for Cyber Squared. While the tactic is not unique, it remains under the radar of most companies.

"I wouldn't say it's new," Barger said on Thursday. "It's just something that folks aren't really looking at or paying attention to."

The gang is among 20 Chinese groups identified this year by security firm Mandiant that launch cyberattacks against specific targets to steal information. In this case, the DNSCalc gang was going after intelligence on individuals or governments connected to the Association of Southeast Asian Nations. ASEAN is a non-governmental group that represents the economic interests of ten Southeast Asian countries.

The attackers did not exploit any vulnerabilities in Dropbox or WordPress. Instead, they opened up accounts and used the services as their infrastructure.

The gang uploaded on Dropbox a .ZIP file disguised as belonging to the U.S.-ASEAN Business Council. Messages were then sent to people or agencies that would be interested in the draft of a Council policy paper. The paper, contained in the file, was legitimate, Barger said.

When a recipient unzipped the file, they saw another one that read, "2013 US-ASEAN Business Council Statement of Priorities in the US-ASEAN Commercial Relationship Policy Paper.scr." Clicking on the file would launch a PDF of the document, while the malware opened a backdoor to the host computer in the background.

Once the door was open, the malware would reach out to a WordPress blog created by the attackers. The blog contained the IP address and port number of a command and control server that the malware would contact to download additional software.

Dropbox is a desirable launchpad for attacks because employees of many companies use the service. "People trust Dropbox," Barger said.

For companies that have the service on its whitelist, malware moving from Dropbox won't be detected by a company's intrusion prevention systems. Also, communications to a WordPress blog would likely go undetected, since it would not be unusual behavior for any employee with access to the Internet.

In general, no single technology can prevent such an attack. "There's no silver bullet here," Barger said.

The best prevention is for security pros to share information when their companies are targeted, so others can draw up their own defense, he said.

In The New York Times attack, the hackers penetrated the newspaper's systems in September 2012 and worked undercover for four months before they were detected.

The attack coincided with an investigative piece the newspaper published on business dealings that reaped several billion dollars for the relatives of Wen Jiabao, China's prime minister.

The promise and perils of replacing your hard drive with Dropbox

Dropbox CEO Drew Houston talked a big game this week when he announced new ways for apps to save and load user data.

More than just a set of developer tools, Houston billed the new Dropbox Platform as a way to “replace the hard drive.” Dropbox Platform is supposed to provide easier ways to store your files in the cloud, with simple buttons that developers can add to their apps. It can also let apps save their own data across platforms, so your work in an Android app can carry over to iOS, and vice versa.

“Today,” Houston said, “the hard drive goes away.”

Houston’s grand proclamations certainly made for some great headlines. But as Dropbox does its best to eliminate the storage woes of the post-PC era, it may also create new headaches when it comes to storing more of our lives in the cloud.

It’s easy to see what Dropbox is trying to accomplish. The company wants to make sure you never have to worry about whether you saved your work on your iPhone, Nexus 7, or Windows PC—similar to what Microsoft is trying to do with SkyDrive, but extending beyond the Windows ecosystem. With Dropbox, your data will always follow you, so you don’t even have to think about it.

"We're swiftly heading towards a world where users paying for cloud storage is going to be as common as users paying for a phone bill," says Matthews. "The interesting part is what happens along the way." Dropbox’s existing apps and desktop sync tools are only half of the equation. The new tools for developers are the other half.
One of these developer tools is dubbed Datastore, and it’s basically a way for apps to save their data to Dropbox’s servers. An obvious example is gaming: Stop playing a game on your Android phone, and Dropbox could let you resume on an iPad. Datastore could also make sense for drawing apps, task managers, notation apps, and expense managers—anything where working across multiple devices is necessary. Users get an easy way to sync their data through a single online account, and developers don’t have to do as much work.
“The main problem is that there aren’t cross-platform options today,” said Jon Peppers, a senior application developer with Hitcents, which makes mobile games and custom enterprise apps. “If we have an iPhone app, we can save stuff in iCloud, and that would probably work great. But if we have an Android app too, Google has its own solution to that. Using Dropbox might be a good option so we don’t have to program that same feature twice.”

In fairness, other cross-platform options do exist for gaming, but they’re mainly tied to social networks, such as Facebook and Google+. Dropbox has more potential to expand beyond games, and to give users an option that doesn’t require social sign-ins.
Dropbox also announced a tool called Drop-ins, which allows app users to save and load their files directly to Dropbox. Whereas Datastore deals with app data, Drop-ins deal with documents, photos, and other files that users might want to access directly, letting you both save and access Dropbox-stored files in-app. Developers can add Drop-ins with just a few lines of code, providing a complete interface for browsing the Dropbox file system.
Again, the idea behind a Drop-in is to reduce friction for users. If developers add “choose from” and “save to” buttons to their apps, users may be encouraged to save more files online, making those files available on any other device.

The seamless availability that Dropbox promises does sound enticing, but it also comes with its own drawbacks.
Of course, there are the obvious concerns, like privacy, security, and reliability. Dropbox has been hacked before, and even accidentally turned off authentication for millions of users in 2011. The service hasn’t been immune to service outages either. And given all that we’ve learned about the NSA and Prism, it’s clear that users can no longer expect complete privacy with their online data. The more data we put online, the more vulnerable we are.
But these concerns existed even before the announcement of Dropbox Platform. Anyone who’s deeply worried about the security and privacy of cloud storage probably won’t find much allure in Dropbox to begin with, let alone the additional features that Dropbox Platform will bring.
The bigger potential pitfall with letting Dropbox “replace the hard drive” is the headache it could create when you run out of storage.
Dropbox has no intention of charging app developers for Dropbox Platform. The company’s business model is the same as it was before: Encourage people to store more data online, so they eventually graduate from free accounts to paid ones.
DropboxDropbox pricing starts at $99 per year and goes WAY higher—but consumer options top out at 500GB. (Click to enlarge.) The problem is that cloud storage is a recurring cost. With Dropbox plans starting at $100 per year for 100GB—roughly the same price as a 1TB external hard drive—the jump to a premium plan can really sting. That’s not to mention the added potential cost of mobile data, as you upload more files and exceed your bandwidth cap.
In fairness, Datastore isn’t likely to be a major drain on users’ storage allotments. For apps that use it, Dropbox is providing 5MB of save data that doesn’t count against the user. According to Jon Peppers at Hitcents, that’s a pretty generous amount for most apps.
But what happens when apps start making it easier to load up your Dropbox storage with all kinds of files, from documents to photos and video? Will users make the leap to paid storage or offload their files to another location, such as another cloud service or a good old-fashioned hard drive?
For that matter, what happens when other services like Google Drive follow in Dropbox’s footsteps, and users have to choose between four or five cloud storage options just to use an app? Between dealing with storage limits and juggling multiple services, suddenly cloud storage requires a lot more brainpower.

“The potential for further headaches is obvious,” said Josh Matthews, CEO of Apkudo, a firm that helps developers optimize their apps for Android devices. “But I think that there are really smart things that Dropbox can do to mitigate those headaches.”
Android, for example, could offer deeper integration with cloud storage services, Matthews said, so users wouldn’t have to sign into their accounts every time they install a new app.
Matthews also sees a bigger opportunity for companies like Otixo and Jolicloud, which offer a central hub for users to manage their cloud storage. That kind of service could become more useful as people begin juggling files between multiple storage services. To limit data consumption, Dropbox could provide a way for users to control which types of files get uploaded, and when, Matthews said.
Still, none of these solutions sound completely headache-free. We’ll still have to decide where our files go, how often to upload them, and when to shift them elsewhere. And Matthews admitted that paying for cloud storage now seems like an inevitability. “We're swiftly heading towards a world where users paying for cloud storage is going to be as common as users paying for a phone bill. The interesting part is what happens along the way,” he said.
Hard drives alone aren't the future, but nor are they relics of the past. That’s not to say the hard drive isn’t becoming more problematic these days. We are increasingly living in a world where juggling multiple devices—phones, tablets, PCs and even TV set-top boxes—is the norm. Relying solely on local storage isn’t the answer, especially when we’re using the same apps across multiple platforms.
But like every other overblown claim about the death of something in technology, Dropbox is not poised to replace the hard drive outright. Instead, it will augment local storage, making it easier to move between devices. We may become more reliant on Dropbox than ever, but rather than abandon our hard drives, we must instead consider, literally and figuratively, how much we’re willing to pay for the privilege.

What developers think of Dropbox as an iCloud alternative

Developers would love to love iCloud. But many of them find Apple’s syncing platform ineffective, unreliable, or worse. Some developers have even pointed to iCloud sync woes as a significant holdup in releasing new versions of their apps.

And now Dropbox, the beloved powerhouse of sync, has taken a direct shot across Apple’s cloudy bow, with the announcement this week of its new Datastore API. Dropbox says that the Datastore API makes simple work of syncing structured data (“like contacts, to-do items, and game state”) across devices—and even platforms: Unlike iCloud, the Dropbox Datastore API works across iOS, Android, and the Web.

Because of the way Dropbox works, it offers one other significant potential advantage over iCloud: Developers who are working with Datastore can actually peek directly at the syncing data on Dropbox’s servers as they test and build their apps, a level of visibility that iCloud simply hasn’t offered to date.

Macworld spoke with several developers to get their thoughts on Datastore as compared to iCloud. Expectations are mixed.

Greg Pierce of Agile Tortoise—maker of sync-friendly apps like Drafts—is pleased by Dropbox’s announcement. “I think it’s exciting to see more players in this space.” Though he’s only played around with Datastore a bit, he said that “if it reliably delivers what it promises, then it’s a potentially very useful API with some real advantages over other sync options right now.”

Pierce said, however, that while “Datastore seems simple to implement,” what it offers doesn’t match directly what iCloud’s Core Data sync does—or is meant to do. That iCloud feature, when it works, should allow apps to reliably sync changes to large, complex databases, without requiring that the full data set be uploaded to the server. Datastore’s “scope is more limited,” Pierce said. All that said, if it works consistently, “that may still make it an attractive option for many apps.”

Charles Perry from Leaf Hut Software thinks Datastore shows promise, too: “Syncing is a notoriously hard problem … Even Apple, with all its resources, couldn’t pull it off. But Dropbox has a proven record in document syncing, so they may be able to succeed where others have failed.”

Not everyone shares Pierce’s cautious enthusiasm.

Tapbots’s Paul Haddad told Macworld that he didn’t even bother looking at the Datastore API. “I don’t really care,” he said. Because it’s not core Apple functionality, Haddad said, “it doesn’t run in the background,” which makes it far less appealing to him. Even with iOS 7’s improved background functionality, Haddad said, Dropbox won’t be able to match the ubiquitous omnipresent syncing that iCloud affords.

Haddad also pointed out that with each successive iOS release since the introduction of iCloud, the under-the-hood mechanics and functionality for its syncing have improved. He’s optimistic that the trend will continue with iOS 7.

Rich Siegel of Bare Bones Software sees the Datastore API as unattractive to many developers in the Apple ecosystem for another reason entirely: “There is no SDK for OS X,” he pointed out, “which makes it an instant nonstarter for any developer who needs to synchronize data between desktop computers, whether or not mobile devices are involved.”

That’s not the only downside for Datastore, either. All three developers mentioned that iCloud doesn’t require users to sign up for a new account, and Dropbox does. That said, “Dropbox has become ubiquitous enough that it is highly likely that someone who downloads your app will already have a Dropbox account and will only need to authenticate with it,” said Pierce, but that’s less assured—and less seamless—than an iCloud-backed option.

“In theory at least, iCloud used with Core Data offers … powerful tools to work with relational data, an extensive query language, [and] tools for working in multi-threaded environments,” Pierce said. Datastore can’t match that functionality. It can’t perform sorted queries, queries that require joining bits of data from multiple datasets, or paginate results—all fairly basic database functionality that’s (at least currently) beyond the scope of what Dropbox offers.

Such features, Pierce said, are a must-have for “larger datasets that cannot all be held in memory.” But he added, “I think the Dropbox Datastore can really shine for apps with small datasets.”

Siegel seemingly concurred: “The question of which service a developer chooses should, I think, revolve around what meets the technical needs of the developer on the way to shipping the product that best suits their customers’ needs.”

If Apple has cause for concern, Perry says, it’s all that cross-platform support that Dropbox offers. “iCloud represents [Apple’s] attempt to lock users into their ecosystem … If Dropbox catches on as a mainstream sync solution, it makes it easier for users to pack up and take their data to other mobile platforms like Android, or even other desktop platforms like Windows.”

“I can imagine a developer will find the Dropbox Datastore API worth a look,” Siegel said, “if their product is not on OS X and they have an interest in structured key/value/record/table database syncing and/or need a solution for both iOS and Android.” If a developer is instead targeting the Apple ecosystem exclusively, Siegel said, iCloud “is the platform-vendor-sanctioned solution, offers integration with the existing platform document and data storage APIs, and is available as part of the stock OS install at no charge.”

Siegel continued: “Dropbox does provide valuable services in the SDK, but these additions, while intriguing to some and potentially useful to many, do not represent an alternative to iCloud.”

Of course, if you want your app to sync to any non-Apple device, or to sync to your service’s website, iCloud won’t work. Said Pierce, “[Dropbox’s] additional flexibility of being able to access that data on Web or Android-based clients is attractive for many apps as well, and not something Apple offers.”

Siegel added: “Anyone who’s been working on iCloud thus far has either made it work, is in a holding pattern waiting for developments, or has gone on to devise and implement an alternative strategy. Although the Datastore API may look promising, in none of those cases do I expect a developer to drop what they’re doing and try to adopt it if they already are in the process of executing an existing plan.”

If your app’s needs can be met by (and synced with) Datastore, added Perry, “then I think you’d be crazy to not at least consider it. The integration won’t be as seamless as iCloud promises to be, but the Dropbox Datastore API opens up all kinds of business opportunities that aren’t possible with iCloud.”

“Ultimately,” Pierce said, Dropbox Datastore “will be judged on how reliably and efficiently it can deliver sync data”—especially because “iCloud Core Data [sync] sounds great on paper, but it practice has not delivered on its promises. If Dropbox can deliver and continue to build on this platform, I think they can become a real player in the database sync arena.”

Gadgetwise: Sharing Files With Dropbox

If I want to share a giant file on Dropbox with other people, do they all have to sign up for Dropbox accounts to see the file?

Although the company’s shared folders feature is handy when everyone has a Dropbox account, the online storage service has more than one way to share a file. For those sharing situations where not everyone involved has a Dropbox account, you can send a secure Web link to the non-Dropbox users.

This Web link directs a person to the shared files, where they can be viewed or downloaded. (Other storage sites, like Microsoft SkyDrive, also let you send links in this manner.)

If you have the Dropbox desktop program for Windows, Mac OS X or Linux installed, you can share a link to a file by right-clicking (or pressing the Mac’s Control key while clicking) its icon and choosing Dropbox and then “Share Link” or “Share Dropbox Link” from the contextual menu.

This action copies the link to the computer’s clipboard, where you can then paste it into a message to send to your friend. You can create shared links in a similar way by right-clicking selected files when you are logged into your account on the Dropbox Web site.

Dropbox update eases worries over offline access to business data

As every hapless teenager stranded in a dank cabin in the psychopath-ridden woods can tell you, your cell phone is useless if you don't have a signal. For business users, the stakes are just as high: Travel to a farflung corner of the world to meet with clients and "zero bars" is a distinct possibility. And God help you if you have to take a plane ride anywhere and aren't lucky enough to get on the handful of jets with onboard Wi-Fi.

While being unable to make calls, send emails, or check the news is certainly an inconvenience, the problem is compounded if you rely on cloud services to actually get work done. Storing data online and running apps that rely on a live Internet connection mean you can abruptly turn into an unproductive layabout when wireless service isn't available.

Hybrid cloud services have started to address the issue, and Dropbox has been leading the charge. Files stored via Dropbox are automatically stored both in the cloud and on your local machine. Changes made to one file are copied in the background when a connection is available, and synced up with all devices running the Dropbox software. Google Drive, SugarSync, and many other cloud storage services work about the same way.

That's a start, but it only addresses the very beginning of the problem. A growing number of services are designed to work exclusively over the Web, and if you're not connected, they simply don't run at all. (Think Facebook.) Well then, why not enable these apps and services to work in offline, hybrid mode, the way Dropbox works? Evernote does it. So does Gmail; it doesn't include all its features from top to bottom, but what it offers is good enough for most users.

Offline support is uncommon because coding this kind of software isn't easy. There are myriad issues to consider: What happens if you change a file in two places before re-syncing? How do you manage the unavoidable data file differences between, say, an iPhone and a Windows 8 PC? And good luck when you bring multiple users into the mix. Imagine five offline users working on a single document simultaneously, then trying to sync en masse. Nightmare. Who wants to try to code all of this stuff themselves?

Well, with the new API releases the company put out this week as part of its DBX developers conference, Dropbox has told the developers of the world that they don't have to. Without getting too far into the weeds, the new APIs mean that third-party developers can now use Dropbox to store program data instead of having to stash it on the user's hard drive or build their own cloud service to store it. That means you'll be able to work on a spreadsheet, draw a picture, or play a game on one device… then pick right back up where you left off on another, whether you're online or off.

With 100,000 apps already supporting Dropbox in some fashion, this isn't a pipe dream. Universal access to data from any device and robust offline support have the potential not just to revolutionize the way we work but to become expected, almost required components of any piece of software we use. As Dropbox CEO Drew Houston told TechCrunch, "Every app is going to be designed this way in the future and we wanted to get started on that now.” I can't wait.

Our top five Dropbox tricks

If you asked Macworld editors to name the technologies they can't live without, you’d inevitably hear about Dropbox. This file-synchronization service lets you access your files from anywhere—not just your Mac, iPad, and iPhone, but also any Web browser. It provides easy cloud-based backup, too. But all that’s just the beginning. Here are five of our favorite ways to use it:

Anyone who passes around photos, videos, or other big files has most certainly discovered the puny file-size limits of most email servers. Dropbox can help. First, make sure you’re running the very latest version of the app by downloading it from Dropbox’s website. Then, in the Finder, find a file in your Dropbox folder, and Control-click, right-click, or two-finger-click it. In the contextual menu that appears, select Share Dropbox Link. (In older versions of Dropbox, choose Dropbox > Share Dropbox Link.) Select this option to copy a shareable URL for the file in question to your clipboard, ready for pasting into an email message or a chat window. Recipients don’t even need a Dropbox account to use links. There’s no quicker way to share large files.—Lex Friedman

To share a big file, just Control-click an item in your Dropbox folder and choose Share Dropbox Link (circled) from the contextual menu.
If you maintain more than one Mac, you know the annoyance of setting up the same app again and again to work just the way you like it. That’s where Dropbox can help. Store an app's preferences in Dropbox, and as you make changes to settings on one computer, those settings also get updated on your other computers. Not all apps let you store preferences in Dropbox, but some notable ones do, including AgileBits’ $50 1Password , Running With Crayons’ free Alfred  with the £15 Powerpack add-on (about $23), Bare Bones Software’s $50 BBEdit , and Smile’s $35 TextExpander . Once you get used to it, you’ll wonder why more apps don’t support this great feature.—Dan Moren

Need to collaborate with a group of people who use Macs and PCs? Dropbox offers an easy way—the shared folder. First you need everyone to sign up for a free account at Dropbox.com. Then, in the Finder, Control-click (or right-click) on a folder inside your Dropbox folder. In the contextual menu that appears, choose Share This Folder. (In older versions, choose Dropbox > Share This Folder.) Your browser will open to Dropbox.com, and a window will prompt you to type in the group members’ email addresses along with a short message for them. Once this is done, the group can add, delete, and edit files in the folder, and the files will stay synced. Since you can access Dropbox through a browser, group members don’t need to download any software to participate.—Scholle Sawyer McFarland

You can see all your shared folders by clicking the Sharing link (shown on the left) at Dropbox.com.
Lots of people upload pictures to Facebook or other services, but not everybody’s Web savvy. For example, at a relative’s recent 50th wedding anniversary, plenty of folks were snapping pictures, but they weren’t sure how to share all of them. My solution? I used the free service Send to Dropbox to create an email address where people could send photos, which I collected into a folder. Then I sent everyone a link to that folder. Easy peasy, and everybody with an email address and Web browser can take part, without having to install any software.—Dan Moren

Need to collect photos from a group of people? The free ‘Send to Dropbox’ service lets them email their images directly to your Dropbox folder.
Have you ever accidentally deleted an important file from your Dropbox folder, or pressed Save and immediately regretted it? Then you’ll be glad to know that Dropbox automatically saves versions of your files from the last 30 days, letting you roll the clock back to an earlier version, or even restore a completely deleted file.

To find earlier versions of files, Control-click (or right-click) on one in your Dropbox folder in the Finder and select View Previous Versions. (In older versions, select Dropbox > View Previous Versions.) Or if you’re viewing your Dropbox folder on the Web, choose Previous versions from the contextual menu. You’ll see a list of numbered versions in reverse chronological order. Dropbox includes other useful information, too: who edited the file, the device on which that editing was done, the date the snapshot was made, and the file size. You can see the contents of any version by clicking its name (Version 44, for example). When you find the one you want, select the radio box next to it and click Restore at the bottom of the screen.

Dropbox automatically saves versions of your files from the last 30 days. Select one and click the Restore button to roll back the clock.
If you want to resurrect a deleted file, the process is slightly different. Visit your folder on the Dropbox website and click the trash-can icon immediately to the left of the search box. This toggles between showing and hiding all deleted files. Deleted files and folders appear in gray and with the Kind deleted file, deleted document, deleted folder, and so on. To bring back a file, click it and find the version you want. Then select that version and restore it.

If you end up using this feature a lot, consider signing up for Dropbox’s $39-per-year Packrat service. It saves unlimited undo history and is available for Dropbox Pro and Dropbox Business users