Landy wrote that some Dropbox and Box users apparently created shared links to their files, which they or their recipients then mistakenly entered into a browser search box instead of the URL bar. How, exactly, that happened involves some conjecture. Security blogger Graham Cluley, who also blogs for Intralink, provides some examples.

That campaign turned up shared-file URLs that led straight to sensitive files that ordinary users had stored on Box and Dropbox-including bank records, mortgage applications and tax returns. Intralinks chief security officer John Landy wrote that his company inadvertently stumbled upon the vulnerability in the course of running a Google Adwords campaign that mentioned its competitors.

Box released an email statement saying that it has found no evidence that anyone has abused such “open links” and touting the various privacy settings it offers its users to “help manage access to their content.” But sending those links out, even to trusted individuals, can also inadvertently give third parties access to your files as well, according to findings publicized by the file-sharing company Intralinks-which, by the way, is a competitor to both Box and Dropbox.ĭropbox says it’s working to fix the problem by disabling any previously shared links that might be vulnerable to leakage. Those files you’re storing on cloud services like Dropbox or Box may not be as secure as you think.īoth services, like other cloud-storage providers, allow users to share links to their stored documents.

Is box dropbox