File opened "x minutes ago" when I didn't open it?

[Jonathan M.5]

I was looking for a file I'd accessed on my phone, but was having a struggle seeing files based on how recently I'd accessed them so I tried on the web client instead

I was shocked to see various flags of files being opened within the last hour that I hadn't accessed! I checked the files and they were only shared/accessable to me, not to anyone else..

I quickly changed my password and removed a slew of older devices I'd used to access Dropbox.

The next morning (now) I've opened the web client again, and more random files that aren't shared with anyone else are still showing as being accessed seemingly "on their own"

Can someone shed some light on this behaviour?

[Jay]

Hi @Jonathan M.5, are the files being accessed definitely not in any shared folder?

What types of files are being opened? Are they in the same or similar locations (as in, part of the same parent folder)?

Have you opened them via the Dropbox desktop app from the icon in the system tray/menu bar? Are you perhaps using the new desktop app to open the files?

Did you find any unknown logins (as in, sessions) when viewing this page from where you removed your devices?

Keep me posted!

[Jonathan M.5]

Hi Jay

Apologies for the horrible delay, I've been courting a new client and a little distracted by that process!

The files seem to be still showing up as being accessed anywhere from within 1 min of when I check the feed to within the last few days - all files I haven't touched, and aren't shared with others. They all seem to be opened or identified as Dropbox Paper (they're documents, not other types of files), although I don't use that platform.. Sadly with my plan, I can't see who's opened them, and I'm pretty disinterested in paying more to track this information - although it's really discouraging that it can't tell me!

I seem to have a slew of 3rd party apps accessing my files (I've been a DBer for a good decade at this point) - Many of the apps I don't recognize anymore.. I wonder if something there is causing the access to show as recent activity (I don't worry too much as the files aren't anything private or important)

I should probably go through and remove the old ones and see if that does anything (although I don't feel like they are associated with the files I'm seeing being opened/accessed) - Would an automated sync with a desktop or mobile device show this activity even if the files weren't changed or accessed? If it's just checking the status?)

[Lusil]

Hey there @Jonathan M.5, 

When a file syncs to another device, you won't receive a notification or find an event logged for this. 

However, if you do see that a file was accessed, could it have been another third party app, like a backup service or an antivirus? 

In this case, you can test it out by temporarily quitting apps until you see that the issue is resolved. The last app that you closed when the issue no longer occurred may be the one performing this action.

Let us know what you find!

[ee22]

Hi, 

This also happened to me today. I was working on a single file and upon exiting noticed that many files I had not opened recently or within months were showing up as recently viewed. These files are in different folders. I do not share these files with anyone else. I changed my password, removed recent devices, and turned on TFA. Since then, I have only seen my activity.

Jonathan, did you find out what was causing this issue?

And to anyone who can help or confirm based on what I have shared, was my account hacked?

[Megan]

Hi @ee22, I'd be happy to help! 

The most common case for this scenario is another, third-party app accessing these files.

If you have any other apps accessing your files, or an antivirus this could be it. 

What I would personally suggest, is what you've already tried in regards to security steps. You can also have a look at your events page, to see more about your file activity there, and make sure nothing suspicious happened. 

The Events page at www.dropbox.com/events gives you an overview of all activity in your account including files events (adds/edits/deletes), as well as adding or removing shared folders. 

If you have any questions, let me know!

[ee22]

Hi Megan,

This still isn't settling well with me. Seeing all those files being opened felt like a violation of my privacy and I'm considering if this is an application I want to continue using.

How can I know for sure if this was a hacker versus a third-party application?

[Walter]

Hey @ee22 - sorry to jump in here, but I just wanted to mention that the events page would be your best bet to find out more about what happened in this case.

Did you take a look to see if the actions are logged there and if so, check the user or the application that initiated them? 

Apart from that, you can have a look at your Security page for any unknown devices or web sessions. 

[ee22]

Hi Walter,

I've returned to this thread because my issue happened again.

When I am on the homepage (https://www.dropbox.com/home) and I filter the 'All Files' list by 'Recent' I see activity that files have been opened that I have not recently visited. But when I look at the Activity log you mentioned, that appears to be accurate.

Why is this happening? Is this a security-related issue?

Thanks.

[Walter]

Thanks for the nudge on this @ee22 

Could you let me know if you notice any difference in the Recents area if you log into your account through another browser? 

Also, where do you usually access your files from? Is it locally on your devices, through the website or via a 3rd party app/integration?