Microsoft silently alters user files on OneDrive

Microsoft appears to be silently modifying user data stored using its OneDrive for Business service by injecting uniquely identifiable code into some files, a blogger in Ireland has found.

Seán Byrne posted on the Myce user forum that he discovered by accident "what gets synced to the cloud is generally not the same as what gets synced back to the cloud, even when noone has touched the files online or elsewhere".

Byrne ran into a syncing issue with some files on OneDrive and decided to check if they were damaged by running a message digest algorithm checksum utility on them to see if the data stored in the cloud was the same as what he had locally.

To Byrne's surprise, the checksums for most of the files did not match and he became concerned that they had been corrupted.

Further testing by Byrne showed that some script files from a website theme had had code injected into them, which would not happen during data corruption.

By creating some empty files with different extensions, Byrne was able to verify that OneDrive altered these during syncing.

According to Byrne's tests, OneDrive adds UUIDs (universally unique identifiers) to HTML and PHP files. Microsoft Office files were enlarged by about eight kilobytes, Byrne noted. 

"Microsoft Office files had what appears to be uniquely identifiable code added, potentially making it possible to match them to a company and possibly even to a specific user’s account," Byrne wrote.

Files being silently modified by a cloud storage service without users' knowledge could have serious consequences, Byrne said. 

"... let’s say a file is used as evidence in a court case. How do you prove that the company did not intentionally modify it?" he said.

Microsoft's consumer version of OneDrive does not alter files, Byrne noted.

The reason files are altered on OneDrive for Business isn't documented by Microsoft. However, several past cases of files being modified by by Microsoft's SharePoint collaboration software have been noted by users, but it was thought only Office data was changed.

CRN's sister publication iTnews has contacted Microsoft for comment.

Update: Microsoft has confirmed it alters data on OneDrive for Business.