Spammers have jumped on the Dropbox bandwagon to push rogue-pharmaceuticals and malware, according to a report by Symantec’s Nick Johnston.
Dropbox, a free, cloud-based file-sharing service, has a couple of features that make it attractive to spammers and malware-writers. One feature allows Dropbox users to create publicly available folders, which essentially turns Dropbox into a free hosting service, Johsnton claims. Dropbox, like any number of other services on the Internet, has a built in URL shortening device that makes it impossible to determine where links actually go.
Symantec identified more than 1,200 spammy Dropbox URLs in use over a 48 hour time-period. Scammers upload image links to the questionable Dropbox accounts. The images use simple html to redirect users to the typical Canadian Pharma scam-sites.
Johnston also notes a recent malware campaign where Brazilian cyber criminals posted a file asking a user to upload some photos to a social network. The folder contained links to infected sites that had been disguised to look like the image file names used by digital cameras. Symantec has notified Dropbox of the problem.
The online file sharing service has run afoul of security and privacy advocates before. In April, security and privacy researcher Chris Soghoian disclosed that Dropbox was overstating its data protection features and, in fact, accessing unencrypted versions of users data, contrary to its stated policy.
