\n<\/a><\/p>\n“We’re working to restore links that aren’t susceptible to this vulnerability over the next few days.”<\/p>\n
Box has not responded to the BBC’s request for a comment.<\/p>\n
Security researcher Graham Cluley said identity thieves could use the method to “scoop up” data.<\/p>\n
“I think these services need to be more upfront with warnings,” he told the BBC.<\/p>\n
However he added that the problem was not a security flaw as such, but instead an unexpected consequence of user behaviour.<\/p>\n
Referral data<\/b><\/p>\n
Mr Cluley has outlined suggestions\u00a0on his blog for how users can restrict access to the public files.<\/p>\n
Both websites offer ways to tighten security on shared links, but doing so limits flexibility.<\/p>\n
“This is the eternal battle sites like this face,” Mr Cluley added. “It’s security versus functionality.”<\/p>\n
Box is another highly successful file storage service<\/p>\n
Dropbox, Box and most other cloud hosting services often give users the option of creating a shareable web link for their files.<\/p>\n
It means users are able to simply send a web address – made up of a string of letters and numbers – for someone to directly download a file without needing to log in.<\/p>\n
Because of the complexity of the link, it is very difficult to guess – meaning that while the link is technically public, it is unlikely anyone would be able to access it by chance.<\/p>\n
However, Intralinks discovered that the links were being exposed in two ways not previously considered.<\/p>\n
Firstly, it discovered that shared links were often appearing in websites’ referral data.<\/p>\n
Many websites look at referral data when analysing their traffic to get an insight into how visitors got to their site.<\/p>\n
Intralinks found that if a link to a website is included in a file shared on Dropbox, and subsequently clicked within the web viewer, the website owner would see the shared link in its referral data – and therefore be able to access the file.<\/p>\n
Dropbox said its patch has now fixed the problem.<\/p>\n
Google ads<\/b><\/p>\n
Furthermore, the company had been running a Google advertising campaign, and had paid to have an advert for Intralinks appear in Google’s search results whenever someone searched for “Dropbox” or “Box”.<\/p>\n
Companies that use Google’s search advertising service are sent an anonymised breakdown of what users had searched for in order to find their advertising.<\/p>\n
Intralinks found that many people would put the entire shared link into a Google search box, and therefore Intralinks would subsequently see those links in the breakdown data from Google.<\/p>\n
While copying and pasting a download link into Google’s search engine might appear to be odd behaviour, Intralinks said “a few hundred documents” were exposed to them in this way.<\/p>\n
Dropbox’s patch has not addressed this particular problem, Mr Cluley said.<\/p>\n
Intralink’s chief technology officer for Europe, Middle East and Africa Richard Anstey said: “Most internet users have, at one time or another, accidentally pasted a link into the search bar of their favourite search engine whilst intending to paste it into the internet address bar – it’s an easy mistake to make.<\/p>\n
“However, what they don’t realise is that when they press enter to execute the search, the advertisement engines that drive (and fund) the search engine will distribute that link as a search term to anyone who has paid for an ‘adword’ that closely matches any part of that link.”<\/p>\n
<\/p>\n
Source: BBC<\/p>\n","protected":false},"excerpt":{"rendered":"
People using file storage services, such as Dropbox and Box, are being warned that they are at risk of inadvertently leaking their own files. Intralinks – which is a competitor – said it found sensitive files, such as mortgage records. The problem centred on the use of the services’ sharing function that generated a public […]<\/p>\n","protected":false},"author":14,"featured_media":16764,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jnews-multi-image_gallery":[],"jnews_single_post":[],"jnews_primary_category":[],"jnews_social_meta":[],"jnews_override_counter":[],"footnotes":""},"categories":[],"tags":[18],"class_list":["post-16763","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-dr-akwasi-osei"],"_links":{"self":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/posts\/16763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16763"}],"version-history":[{"count":0,"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/posts\/16763\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/media\/16764"}],"wp:attachment":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}