Legacy Lenovo login exposed 5,000 Dropbox accounts to hackers
An outdated Lenovo integration put Dropbox users' accounts at risk.
1How the security flaw emerged
Dropbox revealed in an email to around 5,000 users that attackers exploited an old Lenovo login integration. A flaw in Lenovo's email verification process allowed attackers to create Lenovo accounts using Dropbox users' email addresses and access their storage accounts. The company did not explain why the integration permitted access without requiring a Dropbox password.
2Timeline and impact of the attack
The security breach occurred between August 4 and 21. Dropbox told Bloomberg that attackers accessed files belonging to fewer than a third of affected users. Jameson Lopp, co-founder of Bitcoin security firm Casa, stated attackers only attempted to access his locally encrypted 'IMPORTANT.rtf' file.
3Lack of two-factor authentication
Dropbox confirmed to Reuters that none of the compromised accounts had two-factor authentication (2FA) enabled, highlighting the importance of security measures. After discovering the breach, the company terminated all sessions logged in via Lenovo IDs and severed links between affected accounts and Lenovo.
4Recommendations for users
Dropbox advised affected users to change their Dropbox and personal email passwords and enable 2FA. Lenovo told Reuters its customers were unaffected and the investigation is ongoing. Further details were requested from both companies.
5Similar incidents in the industry
This incident serves as a reminder of security risks between cloud storage providers and third-party integrations. Similar integration flaws have led to major data breaches in the past. Companies must regularly review legacy systems and users should enhance security measures.
6Lenovo's responsibility
A flaw in Lenovo's email verification process enabled attackers to access Dropbox accounts. While Lenovo claims its customers were unaffected, determining which party is responsible for the security gap is crucial. This raises questions about accountability in cross-company integrations.
7Dropbox's response and measures
Upon discovering the breach, Dropbox promptly terminated all sessions logged in via Lenovo IDs and severed connections between affected accounts and Lenovo. The company also advised users to change passwords and enable 2FA. However, why the integration allowed password-less access remains unanswered.
8Key takeaways for users
This incident underscores the importance of enabling two-factor authentication for cloud storage accounts. It also shows companies must regularly audit legacy integrations and patch vulnerabilities. Users should routinely review third-party apps linked to their accounts and remove unnecessary integrations.