topic dropbox? in Network Security

dropbox?

lukeprimm — Sun, 10 Mar 2019 12:25:34 GMT

Im running IDM 7.0 and was wondering if there is a way to alert on our internal clients using the dropbox.exe application? If so, what signature? Or, any other ideas? Thanks

dropbox?

rupadras — Sun, 24 Jul 2011 22:33:27 GMT

Hi Luke,

I will look into writing signatures to detect this. I will update this thread in a few days.

thanks,

Radhika

dropbox?

lukeprimm — Mon, 25 Jul 2011 21:03:46 GMT

Thanks that would be gret. Im surprised that there is not already something in place since cloud services like these are a major security hole. We are also looking into icloud and how it might open up new holes. THanks again for your help on this.

dropbox?

lukeprimm — Thu, 11 Aug 2011 15:19:24 GMT

Any progress on this? I appreciate it.

dropbox?

rupadras — Thu, 11 Aug 2011 19:11:41 GMT

yes, Sorry, I should've updated this post already. I have two signatures for dropbox client that should be released soon. Here are the details.

Signature 1:

This one fires when the client is in use.

engine: service-http

uri-regex: [\x2f\x5c]subscribe

arg-name-regex: host[_]int

request-regex: ns[_]map

header-regex: dropbox[.](com|net)

ports: #WEBPORTS

Signature 2:

This one fires when the client syncs over LAN (LAN Sync Discovery Protocol)

engine: multistring

protocol: UDP

port-selection: both-ports

source-port: 17500

dest-port: 17500

regex strings:

\x22host[_]int\x22\x3a

\x22version\x22\x3a

\x22displayname\x22\x3a

\x22namespaces\x22\x3a

I'd set the Summary-Mode Under Alert-Frequency to "Fire Once" for signature 2, or it will fire too often.

The signatures will be part of an upcoming sigupdate. I will also look into icloud later on.

Please let me know if you have any questions.

thanks,

Radhika

dropbox?

lukeprimm — Thu, 11 Aug 2011 19:16:41 GMT

Thats exactly what I was looking for, thanks!!

dropbox?

rrfield — Thu, 20 Oct 2011 15:16:09 GMT

the dropbox signature works great.

Any idea when this and signatures for other cloud storage services will be made available in an update?

dropbox?

lukeprimm — Thu, 20 Oct 2011 15:23:07 GMT

How did you implement it? Im a bit of a novice with IPS. Thanks

dropbox?

rrfield — Thu, 20 Oct 2011 15:27:51 GMT

Created a custom signature...if you are using IME, go to...

Configuration > ipsname > Policies > Signature Definitions > sigX > All Signatures

In the upper right area of the IME screen there is a button called Signature Wizard, which will lead you through the steps to create a custom signature. The signature IDs beging with 60000.

Use the values provided by rupadras.

One note, I did not create the second dropbox signature...I did not see an option for the engine "multistring"...and the "String UDP" did not allow more than one regex. I guess I could create a subsignature for each regex provided?