Dropbox must be covered in shame after it emerged that 60 million account details were hacked backed in 2012. It was just last week they sent emails to accounts holders to upgrade their login details.
Then, the folks at Dropbox claimed all pre-2012 account holders should effect the change as a precautionary measure, not because users accounts have been hacked.
Many believed the proactive stance they took 4 years ago basically deflected an impending disaster. But it turned out that Dropbox had no idea of the scale of the problem, or knew about it but chose to cover up so they won’t lose their reputation as a secure storage service.
I guess the email last week to account holders to upgrade their details, coming four years after the supposed breach, should have set off alarm bells in everybody. Somehow we took Dropbox’s word that nothing was amiss.
The chain of events that exploded to the exposure of the Dropbox hack started when Leakbase, who are in the business of notifying stakeholders about security breaches got hold of the database containing Dropbox users’ details and sent it over to Motherboard.
This is how Motherboard reported the find on their website:
Hackers have stolen over 60 million account details for online cloud storage platform Dropbox. Although the accounts were stolen during a previously disclosed breach, and Dropbox says it has already forced password resets, it was not known how many users had been affected, and only now is the true extent of the hack coming to light.
Motherboard obtained a selection of files containing email addresses and hashed passwords for the Dropbox users through sources in the database trading community. In all, the four files total in at around 5GB, and contain details on 68,680,741 accounts. The data is legitimate, according to a senior Dropbox employee.”
As for Troy Hunt (he also featured prominently in verifying that the Tumblr accounts hacked earlier in the year were really authentic) and his website haveibeenpwned; he also got hold of the huge database and confirmed that the accounts indeed belonged to Dropbox users. He even found his account details and his wife’s too:
Now this isn’t “cracking” in the traditional sense because I’m not trying to guess what her password was, rather it’s a confirmation that her record in Dropbox is the hash of her very strong, very unique never-used-anywhere-else password. There is no doubt whatsoever that the data breach contains legitimate Dropbox passwords, you simply can’t fabricate this sort of thing. It confirms the statement from Dropbox themselves, but this is the kind of thing I always like to be sure of.”
In a widely circulated email, this is how Dropbox tried to explain this disclosure:
There is no indication that Dropbox user accounts have been improperly accessed. Our analysis confirms that the credentials are user email addresses with hashed and salted passwords that were obtained prior to mid-2012. We can confirm that the scope of the password reset we completed last week did protect all impacted users.”
As usual, that is the normal corporate speak to put a nice spin on a very bad situation. But the fact still remains that about 60 million Dropbox users had their account details stolen. And Dropbox tried to cover it up.
And to make it worse, it seems the breach came from a Dropbox staff whose online account was hacked. That particular account contained details of how to access Dropbox main servers.
Are we ever going to see the day when full disclosure becomes part of the corporate culture? I doubt it. We are still going to be dependent on security experts to keep telling us the real truths about incidences like this.
If companies like Dropbox had their way, independent researchers like Troy Hunt would have no reason to be walking free like the rest of us ignorant folks.
image credit: theguardian.com; sourceit.net; twitter.com; cnbc.com; apisrilankan.com