Intruders Pilfered Over 68 Million Passwords In 2012 Dropbox Breach

But all passwords were hashed and salted and no evidence they have been misused, company says.

Reports this week that as many as 68 million email addresses and passwords were leaked online as the result of a 2012 breach of Dropbox has grabbed wide attention for its sheer scope. But the fact that all of the passwords were hashed and salted makes the incident less severe for users than it otherwise might have been.

In a seemingly routine email, Dropbox last week said that users who had signed up for the service prior to 2012 and had not changed their password since then would be prompted to reset it when they next attempted to sign in.

It also encouraged individuals who used their Dropbox password to log into other sites to change passwords to those sites as well, and recommended that they enable two-factor authentication as an additional security measure for protecting access to their accounts.

The company described the move to proactive reset user passwords as a purely preventive measure and not because there was any indication of accounts being breached. “Our security teams are always watching out for new threats to our users,” said Patrick Heim, head of trust and security at Dropbox in the email.

As part of these efforts, the company learned about a set of email addresses, together with hashed and salted passwords, that were illegally obtained in a 2012 security incident and subsequently leaked online.

“Based on our threat monitoring and the way we secure passwords, we don’t believe that any accounts have been improperly accessed,” Heim said. In comments to Motherboard, he said Dropbox initiated the reset to ensure that passwords from prior to 2012 cannot be used to access user accounts. Motherboard, which examined the leaked data, said about half of the passwords appear to have been hashed using the bcrypt hashing function, and the rest were protected via SHA-1.

Dropbox had originally described the 2012 security incident as one in which someone had used a stolen password to access an employee account that contained a document with user email addresses. At the time, Dropbox had said the incident only involved a small number of email addresses.

This week’s sudden broadening scope of the breach triggered many familiar recommendations from security experts on what users need to be doing to mitigate fallout from breaches like this.

“This has become a common enough occurrence that people should be taking all of the most common precautions with their user accounts and passwords when using online services,” said Nathan Wenzler, principal security architect at independent security consulting firm AsTech Consulting in a statement.

Breaches like this show why it is important for users never to reuse passwords across sites and to ensure passwords are long enough and complex enough to make them difficult to guess via brute force methods.

“There’s a reason why companies have their employees change their passwords regularly. Employ the same practice for your personal accounts and credentials, too,” he said.

The breach is an important reminder why passwords alone are no longer sufficient as a form of user authentication said Ryan Disraeli, co-founder and vice president of mobile identity company TeleSign.  

“Dropbox appeared to practice good user data security protections, encrypting the passwords and updating the encryption standards.” But as the breach shows, even when good protections are used, passwords alone cannot provide enough protection, he said in a statement.

Meanwhile, DropBox’s failure so far to disclose why it took the company more than four years to discover the true scope of the breach drew criticism from some quarters.

The fact that user accounts taken in an incident in 2012 are only now coming to light is significant, said Chris Roberts, chief security architect at advanced threat detection vendor Acalvio.

It would interesting to know why Dropbox didn’t do more to determine the true scope of the 2012 intrusion until someone actually leaked the hacked accounts, he said in a statement. “It would be good to work out or understand why Dropbox didn’t put its hand up and admit the issue back in 2012.”

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

More Insights

More Than 40% Of Attacks Abuse SSL Encryption

New report shows risk of not inspecting encrypted packets.

There’s an important caveat about encrypted traffic from new research released this week: Encryption works so well that hackers are using it as cover.

A new study from A10 and the Ponemon Institute found that 80% of respondents say their organizations have been the victim of a cyberattack or malicious insiders in the past year — and 41% of the attacks have used encryption to evade detection. In addition, 75% say malware hidden within encrypted traffic is a risk to their organizations.

At issue: The report found that SSL encryption not only hides data from would-be hackers but also from common security tools.

“Hackers are using SSL encryption to slide by standard perimeter defenses,” says Chase Cunningham, director of cyber operations at A10 Networks.

Cunningham says companies need to start thinking about using technologies that can inspect SSL packets and quarantine the bad or malicious packets. He adds that it’s going to become even more important as organizations move encrypted data out to the cloud – companies need to know if all those encrypted packets out in the cloud are secure.

The three main reasons organizations don’t decrypt encrypted traffic, according to the report: lack of enabling security tools (47%), insufficient resources (45%), and performance degradation (45%). 

Another 53% of the respondents admit that their security solutions are collapsing under growing SSL bandwidth demands and key lengths.

Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, says the A10 research validates what they’ve been saying for the past several months about the dangers lurking inside encrypted traffic. He points out three aspects to inspecting encrypted traffic.

First, companies must focus on key management for inbound traffic. Bocek says they need to know where the keys are and use automated tools that keep them regularly updated.

Second, companies need to set up a trusted authority for outbound traffic so when the system initiates a new connection, a new certificate is created. Bocek says most security tools have these kinds of capabilities.

Finally, the same kind of key management a company sets up for inbound traffic must be used for internal (East-West) traffic. “Basically for East-West traffic the company controls the end, whether it’s one data center to another data center or one network segment to another network segment,” he adds.

Bottom line: Security managers need to understand that encrypted packets represent a legitimate threat that must be managed and inspected regularly. 

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

More Insights

2016 DDoS Attack Trends By The Numbers

Some highlights from recent reports on DDoS attack activity.

Previous

1 of 9

Next

Image Source: Adobe Stock

Image Source: Adobe Stock

As inevitable as death and taxes, distributed denial of service (DDoS) attacks against the enterprise continue as strong as ever. According to all of the latest data, 2016 has seen DDoS attacks intensify in frequency and size, particularly as attackers are increasingly using DNS and DNSSEC to amplify attacks for greater impact against their victims using fewer botnet resources.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous

1 of 9

Next

More Insights

2012 Dropbox hack worse than realized, 68M passwords leaked

dbhack.jpg

Image: iStockphoto/weerapatkiatdumrong

Just days after Dropbox prompted users to reset passwords as a result of a hack that occurred in 2012, more information has surfaced that showed how massive its impact was. According to a recent report by Motherboard, more than 68 million accounts were affected, where both email addresses and encrypted passwords were leaked.

Dropbox acknowledged the breach at the time it occurred, but it didn’t disclose the full extent of the hack. Language used by then-VP of engineering, Aditya Agarwal, also seemed to point to the idea that Dropbox believed only emails were stolen in the attack.

A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses. We believe this improper access is what led to the spam. We’re sorry about this, and have put additional controls in place to help make sure it doesn’t happen again.

Motherboard was originally provided the information by a company called Leakbase, which gained access to the dataset and sent it to Motherboard. According to Motherboard, it received files “containing email addresses and hashed passwords for the Dropbox users.” The four files totaled 5GB in size, and Motherboard reported that a senior Dropbox employee confirmed the legitimacy of the data.

SEE: Information security policy template (Tech Pro Research)

Citing Patrick Heim, head of trust and security for Dropbox, Motherboard noted that last week’s password reset likely covered all users who would have been impacted by the breach. Additionally, no malicious activity has been discovered on the accounts, Dropbox told Motherboard.

More about IT Security

Hopefully, the impact will be minimal, if there is any impact at all. As noted by several outlets, the passwords that were stolen were encrypted, so they will likely not be able to be used by the hackers.

If you are a user, especially if you have a business account—change your Dropbox password. Even if the passwords are encrypted, it’s an easy step to take to protect yourself and your organization.

Perhaps the biggest lesson that enterprise users can learn from all of this is the importance of security hygiene for every employee. The initial 2012 hack occurred because a Dropbox employee was using the same password to log into their corporate account as they were on another site. That password was stolen from the other site, and used to access Dropbox’s network. So, encourage your employees to not use the same password across multiple sites, and to change their password often.

The 3 big takeaways for TechRepublic readers

  1. A new report from Motherboard revealed that the 2012 Dropbox hack affected more than 68 million accounts, leaking email addresses and encrypted passwords.
  2. The passwords were encrypted, and there doesn’t seem to be any malicious activity happening on the affected accounts.
  3. Dropbox users should reset their passwords, and employees should be sure not to use the same password across multiple accounts and websites.

Also see

FTC Warns Travelers About Cybersecurity Risks Of Rental Cars

The Federal Trade Commission has recommendations for consumers to protect their personal data when driving rental vehicles.

Driving a rental car this summer? Your personal information may be at risk, warns the Federal Trade Commission (FTC).

The FTC yesterday released an alert warning car rental customers to safeguard their personal data when using vehicles that include network connectivity. Drivers may be unknowingly making their data vulnerable, as cars continue to store information after they are returned.

Many connected cars are equipped with infotainment systems that work with a driver’s personal devices so he or she can navigate, stream music, and use hands-free calling and texting from behind the wheel.

These systems can store data like previously entered GPS locations, which could include a driver’s home or work address. They may also keep mobile phone numbers, contacts, call logs, or text messages.

The FTC shed some light on precautions rental car customers can take to ensure the safety of their information when driving connected cars.

  • Drivers should avoid connecting their phones or electronic devices to an infotainment system for the sole purpose of charging. If your phone is low on battery, it’s better to use a cigarette lighter adapter to charge instead of the USB port, which may automatically transfer and store data.
  • If you do connect a device to the infotainment system, it may display a screen to ask which types of information you want the system to know. In this case, be sure to only grant access to necessary information; for example, don’t share your contacts if you only want the system to play music.
  • Finally, delete all personal data from the infotainment system before returning the vehicle. Within the system’s settings, you should be able to locate a list of devices connected with the system and follow instructions to delete data. If the process proves tricky, the car’s manual or rental company should be able to give more information.
  • If drivers don’t delete this data before the car is returned, they risk the possibility of sharing it with future renters, rental car employees, or cybercriminals.

As part of its rental car alert, the FTC encouraged rental car customers to heed security advice from the United States Computer Emergency Readiness Team (US-CERT), which published a security tip on the vulnerability of all electronic devices to cyberattacks.

The US-CERT’s advice may seem like common sense to security pros, but it’s worth remembering as more connected devices make their way into everyday life. Some of its tips include keeping device software up to date, encrypting files when storing personal and corporate information, disabling remote connectivity, and using caution with public wifi networks.

Car hacking has been in the spotlight for a while and researchers are working to build tools for discovering vulnerabilities in vehicles. In June 2016, French researchers announced plans to release CANSPY, a tool for testing weaknesses in a car’s local communications network.

Related Content:

Kelly is an associate editor for InformationWeek. She most recently reported on financial tech for Insurance & Technology, before which she was a staff writer for InformationWeek and InformationWeek Education. When she’s not catching up on the latest in tech, Kelly enjoys … View Full Bio

More Insights