Child Item

File accessed time changed

Sorry if this is a repeat. I went back in and could not find the original using Search. Label is 'Security'

When I do a dir /s /a: /o:d /TA c:\*.* I am observing the file access date and time is all over the place in Dropbox subfolders that I do not access at all - certainly haven't looked at them for years and years. There are no other machines connected to my Dropbox, just one, my machine. Everything had already been "revoked".

That tells me either someone on my machine (virus) is accessing these files or someone at Dropbox is accessing them through the Dropbox service. Perhaps Dropbox does occasional sanity check true file comparisons and in between, it only looks at what Windows tells it changed combined with file size and date last modified on my machine vs. it's servers. If so, I'd like them to state that in documentation as it is disturbing to see the file accessed time changed all over the place and wonder who did this. No one else has physical access to my machine.

Here is an example of a folder I have not looked at for 4 years. I have changed the file names for privacy.

Directory of c:\Users\Admin\Dropbox\Final\2019\OLD
04/29/2022 05:42 PM 81,537 Chec..xlsx
03/20/2023 01:15 AM 555,250 2018 ...
04/11/2023 03:02 PM 3,077 payment1
04/22/2023 06:55 AM 11,933 payment1
05/18/2023 05:02 PM 553,498 YForm
05/21/2023 09:18 AM 74,490 Ledger.xlsx
06/03/2023 04:36 PM 2,979,840 SupportingInfo
06/04/2023 05:48 PM 3,052,094 2018YForm
06/05/2023 02:19 AM 41,695 TurboTaxReceipt86

Find more posts tagged with

Security

Disagree

Comments

Rich

@harryisthename wrote:
... or someone at Dropbox is accessing them through the Dropbox service

Dropbox doesn't access your files through the normal operation of the service, and they certainly can't access the files on your computer. They may be able to access the files in your account while providing support (i.e. you've submitted a help desk ticket that requires them to access your account, etc.), but they aren't accessing your files otherwise.

harryisthename

That's what I would like to think. Unfortunately, I have to do the deep forensics to discover what is doing this. I can monitor access on my end and see if Dropbox is doing it locally. That is, I still believe Dropbox service is doing this because it is very challenging and time consuming to verify the integrity of uploads of changed files. That's because the computer can crash, files can be modified offline (command prompt from a recovery flash drive), there can be an over-reliance on the Volume Shadow Subsystem which can be problematic in a less than healthy computer, hard disk drive issues can occur (soft NTFS and hard disk errors), anti-virus filters screwing up (my Ransomware protection is off), the Dropbox service itself being problematic, etc., etc. Note I have the Free Dropbox. Thus integrity checking is paramount and the grand challenge is to do it without affecting local or Dropbox-server performance. I have seen a few posts circa a few years ago about desiring file integrity checking with no clear answer. Perhaps it finally got implemented.

That is, it is not enough to verify file integrity by looking at which files I have in my 1M files at startup and comparing only the filenames (paths) and file sizes and dates/time modified to what Dropbox has in the cloud or relying entirely on VSS. Even calculating MD5 hashes is time consuming on 1M files. At some point it behooves the Dropbox servers to sample individual files and do a true file compare or at the very least do an MD5 compare. And if my (Free) Dropbox has 1M files, it certainly cannot do a true file compare at Windows Startup - too time consuming. With my Free Dropbox, it might instead do a MD5 hash compare on portions of the 1M files and flag which ones it has done -- it would do more and more over time to spread the load of it's servers (and my local machine) not being overwhelmed doing all 1M files MD5 compares at a time. Such an MD5 compare would open and close the file locally and cause the date accessed to be changed. This might explain what I saw.

Unfortunately, Dropbox does not (as far as I know) disclose under what conditions it will access the file locally -- you believe it **does not** and I respectfully believe it might. It's important for me to know so I can take steps accordingly to monitor rogue file accesses. Unless you are a Dropbox engineer who definitely knows the answer, the answer remains a puzzle. Only someone from Dropbox can authoritatively answer this question, IMHO.

Sam DBX

Hi all,

Thanks for your input on this. To explain a bit, there are two main components to how the Dropbox desktop application keeps your files in sync:

During normal operation, it patiently waits for any file activity like a new file added/edited/deleted from your Dropbox folder. When that happens it syncs those changes to your account.
During startup, the application indexes your Dropbox files to check for changes made locally while the application was off, or remotely from your other devices/accounts you share with.

This is how Dropbox can keep your files in sync, even if your computer isn't online 24/7. So, even if you're not making changes to the files directly - this likely accounts for what you’re seeing as far access times.

From our side, rest assured that your files are safe, and if you're curious about our internal security procedures, we have lots of information in our security whitepaper.

Hope this helps!

harryisthename

Hi Samantha, thank you very much! I need some time to investigate further. Thank you for the useful whitepaper. Perhaps you can comment on this:

Using SysInternals procmon, I am seeing that one or two times a day, Dropbox mysteriously chooses perhaps three or four files to do procmon operations of QueryEAFile on the file (say C:\Users\Admin\Dropbox\PITCH.51:COM.DROPBOX.ATTRS) (which BTW returns an INVALID PARAMETER code) and causes Windows Defender (Msmpeng.exe) to open and read the first 26 bytes of the original file (C:\Users\Admin\Dropbox\PITCH.51) and close the file. This may be what causes the file access time to change. I have no idea what provoked Dropbox todo the QueryEAFile (see https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntqueryinformationfile ) and I am aware many people have complained for years about such files being created and remaining around (not the case here - they do not remain around). See https://help.dropbox.com/sync/extended-attributes .

Dropbox always states it's likely a shared folder or syncing to a device that is using a different file system and this is needed to propagate extended attributes from one file system to another. Fair enough. But there are no other devices connected to the account (a Free account), everything has been revoked, the password was changed, 2FA was set up, sfc /scannow, chkdsk C: were done, no other anti-virus is running, I went through autoruns with a fine tooth comb and the issue persists and apparently had been going on for months. I intend to study this, with hopefully your help -- otherwise I am overwhelmed trying to attempt this on another clean install of Windows 10.

Just a few files per day. It gets more interesting: I will add that at one point I saw on the portal Security settings an Android device which was connected to an ASN router belonging to my ISP and a few miles from my home. That was strange and smacks of (SWAG) MITM. It's very challenging to research this and get Spectrum or Dropbox to help. The natural inclination is: we do a great job and it has to be something on your end. Understood. But your help is appreciated and it's in your best interest to take this seriously, which I believe you do. I deleted that connection and the issue persists. I have never installed Dropbox on my Android phone. If I am contacted privately, I will be happy to provide screenshots and more procmon logs. Either I am being spied on (I have nothing to hide), my Dropbox is compromised/rogue, or my Windows Defender is compromised/rogue. I will be studying this further.

I am including a snippet of a procmon log for a file PITCH.51

This is important because Digital Forensics depends on the file access time for monitoring of file integrity and suspicious behaviors. It is challenging enough to get that last access time correct and interpret it, Dropbox (or Windows defender) just confuse the matter if they are responsible for these (possibly) unnecessary file access updates.

I will continue to update as I learn more.

Blessings!

Harry

Procmon for pitch.51

Sam DBX

Hi Harry,

Thanks for the detailed information.

We'll look into it and get back to you to share some insights if available.

Thanks for your patience so far!

Sam DBX

Hey Harry,

Thanks for holding on. Here are some points we can provide a bit more info:

First one (as you've mentioned) Dropbox does occasional sanity check true file comparisons and in between. Basically, we monitor the designated path of the syncing Dropbox folder and wait for filesystem events like add/edit/delete from the OS, which triggers a response from the Dropbox desktop application to then index/sync any changes that were made.

Regarding other devices connected to your account, we are happy to look into this further for you, and get a better understanding of what you're seeing at your end.

I’m sure you’re aware of these steps, but not harm in reinstating - if you suspect that an Android device has accessed your account without your authorization:

Change your password
Review your connected devices: http://www.dropbox.com/account/security
Disconnect any devices you don't recognise

Again, we can surely look into this further for you (via our support ticket).

Best!

harryisthename

Hi Samantha, thank you again for your thoughtful reply. I believe you can see my email address from this message. If so, can I trouble you to *PLEASE* privately email me as there are some rather very important things I would like to discuss with you privately. I do intend, for transparency sake and as a professional courtesy to those who are following this post, to ask you at some point to summarize what we conclude privately, which may take a bit of time. Or perhaps I can summarize down the road.

In the meantime, my only comment about the sanity check scan -- it's good to know you do that from time to time BUT it does not apply here as the procmon tool did not reveal any Readfiles for the file compares -- just the Create, close and read (by Windows Defender) of the 26-byte com.dropbox.atttrs file. If this were a sanity check, the dropbox service would have to read and return the data to the cloud for cloud-compare (or the cloud would have to download the cloud version of the file to the local machine data for the local machine to compare to it's local copy).

I look forward (hopefully) to your email.

Blessings,

Harry

Sam DBX

Hi Harry,

Not a problem, always happy to help.

Our team has been advised to contact you directly (via email).

Ps: if you haven't done so, please verify your email address, so we can fully assist you there: https://help.dropbox.com/account-access/verify-email

Thank you!

harryisthename

Hi Samantha. Thank you! Are you able to confirm I verified? I logged off and logged in to my dropbox account on the portal but no verification email was sent nor did I expect one -- 2FA was in effect and I got a code on my cell. I did not state the device was a trusted device. I'll wait to hear from Dropbox privately. It's possible you meant a verification email from the community blog which I believe is separate (I am using the same email however); not sure.

Thank you so much!

Harry

Sam DBX

Hi Harry,

I've asked our team to resend the verification email, let me know if you got it.

Thanks!

harryisthename

Hi Samantha,

Thank you again!

I've gone through a couple of rounds of verifying my email and account but the problem is that because I have a free account, I see no way of communicating to suppport my private findings. I see a link to a chat bot, a link to community (such as here), and general answers to general questions.

Please let me know if I am confused and if it is possible to temporarily give me a paid account or for me to upgrade my account and later revoke it so I can engage in a normal email and support ticket assigned to a person who can address my security concerns.

Thank you again!

Harry

Sam DBX

Hey Harry,

We've engaged with our support team (and we have your info/email). That should be ok!

You should hear from us soon.

Thanks again.

harryisthename

Hi Samantha, can I trouble you to followup as I have not been contacted by anyone yet. I think your last note to me was Wed 06/21/2023 one week ago saying they would reach out.

Blessings,

Harry

Sam DBX

Hi Harry,

Apologies for the late reply here. I can see that you're already in touch via email.

Let me know if you need anything.

Thanks!

harryisthename

Yes, thanks. I am in communication and submitted my report and thank you for connecting me to support! I asked "D" to reply if he has been seeing my emails in support including the detailed Word attachment. Hopefully he has. Thanks, Harry

harryisthename

Hi Samantha,

Are you able to tell if "D" (name omitted to respect his privacy) received my Word attachment I emailed Thu July 6 11:34 PM? I asked for an acknowledgement it was received and have not heard back. Thank you, Harry

Sam DBX

Hi Harry,

No problem, the communication is set as ''open'', but I will check if I can provide a timeline for you.

Thank you!

harryisthename

Hi Samantha, take a look at "D"'s response and mine to his in the ticket. I'm sure you will find it interesting. In any case, I would appreciate keeping this blog open as unsolved. Thanks, Harry