Dropbox Hacked - 68 million user details leaked

Summary

This 2016 blueAPACHE blog post reports on the disclosure that credentials for more than 68 million Dropbox accounts, stolen in a 2012 breach, had resurfaced online four years later via the breach notification service Leakbase. It is written for general business readers and IT staff who want to understand what happened and what practical steps reduce their own exposure to credential-based attacks. The post explains how the passwords were hashed and salted, what Dropbox did in response, and closes with a set of password hygiene recommendations. It still applies because the underlying lesson, that old credential breaches can resurface years later and that password reuse remains a primary risk multiplier, has not changed even though this specific incident is now historical.

Key facts

Article

Usernames and passwords of over 68 million Dropbox users have been leaked online

In 2012, cloud storage service provider Dropbox disclosed that hackers had gained access to a project document containing Dropbox user email addresses, through a compromised employee account. The company reported that all impacted users had been contacted and their accounts protected with forced password resets. There was no mention of the exact number of users impacted or that passwords had also been stolen. Now, four years after the fact, the true extent of the hack has been revealed. In a recent post, the tech blogging and news website, Motherboard, reported that it has obtained account details of more than 68 million Dropbox users, from the breach notification service, Leakbase. The files containing Dropbox user credential (email addresses and passwords) has been linked back to the 2012 hack. According to Motherboard, a senior Dropbox employee has verified the legitimacy of this data.

The Impact

Although the stolen files have not yet appeared on the dark web, Dropbox joins a growing list of high profile data breaches targeting social networking and other organisations. The list includes LinkedIn and Tumblr, whose user credentials were sold online, following years-old data breaches. Dropbox has not yet seen any malicious access of these accounts. It has been reported that all of the stolen passwords were hashed and salted making this incident less devastating for users than it otherwise might have been. Of the stolen passwords, around 32 million were secured using the hashing function BCrypt, while the rest were hashed with the SHA-1 hashing algorithm. These password hashes are also believed to have used a Salt – a random string added to the hashing process to further strengthen passwords, making them very difficult to crack. Dropbox has also changed its password hashing practices several times since 2012, in order to keep passwords secure. The company launched a major password reset, a week before the leak become public. “We’ve confirmed that the proactive password reset we completed last week covered all potentially impacted users,” said Patrick Heim, Head of Trust and Security for Dropbox. “Even if these passwords are cracked, the password reset means they can’t be used to access Dropbox accounts.” However, Heim did add, “While Dropbox accounts are protected, affected users who may have reused their password on other sites should take steps to protect themselves on those sites.”

The Takeaway

Incidents like these reiterate the importance of ongoing password management to mitigate the impact of such breaches. There are simple steps that you can take to strengthen your online security:

• Avoid using the same password across different websites and different accounts.
• Change your passwords frequently.
• Do not store copies of your password in documents that others can access. Instead, use a good password manager (you can also use a password manager to create complex passwords that are harder to crack).
• When possible, access your accounts only from secure devices. If you are using a non-personal device, always remember to sign out at the end of your session.
• Enable two-step verification where available. This will necessitate two proofs of identity (such as your password and a temporary code sent to your phone) when signing in.

If you are a Dropbox user and have concerns about your data security and privacy, you can visit the Dropbox help centre for more information. If you would like more information on internet security, or if you would like to arrange training sessions for your staff, contact the blueAPACHE account team.

Related

• emPOWER Security — blueAPACHE's security service, relevant to the credential protection measures this post recommends.
• Security pillar — the wider emPOWER Security pillar this service sits under.
• emPOWER Cloud — blueAPACHE's certified cloud platform, relevant to businesses assessing cloud storage provider risk.
• Cloud pillar — the wider emPOWER Cloud pillar.

Frequently asked questions

What happened in the Dropbox breach this post describes? In 2012, Dropbox disclosed that hackers had accessed a project document containing user email addresses through a compromised employee account, but did not disclose at the time that passwords had also been stolen. Four years later, in 2016, more than 68 million account credentials from that breach surfaced via the breach notification service Leakbase, as first reported by Motherboard.

Were the leaked Dropbox passwords immediately usable by attackers? The post states the stolen passwords were hashed and, for most of them, salted, which makes them significantly harder to crack than plain-text passwords. Around 32 million were hashed with BCrypt and the remainder with SHA-1, and Dropbox had already run a proactive password reset covering all potentially impacted users before the leak became public.

Did Dropbox notify users again once the scale of the breach became clear? The post reports that Dropbox's then Head of Trust and Security, Patrick Heim, confirmed the earlier proactive password reset covered all potentially impacted users, meaning cracked passwords could not be used to access Dropbox accounts directly. Heim did note that users who had reused their Dropbox password on other sites should still take steps to protect those other accounts.

Why does password reuse make incidents like this worse? Because if a user reuses the same password across multiple services, a credential leak from one breached service (even one hashed and salted) can eventually expose accounts on unrelated services once cracked or if reused in plain text elsewhere. The post lists avoiding password reuse as its first recommended mitigation.

What password hygiene steps does the post recommend? The post recommends avoiding the same password across different websites and accounts, changing passwords frequently, not storing password copies in accessible documents, using a password manager, accessing accounts only from secure devices and signing out on shared devices, and enabling two-step verification where available.

What is the difference between hashing and salting a password, as referenced in this post? Hashing converts a password into a fixed-length value that is not easily reversible, while salting adds a random string to the password before hashing so that identical passwords do not produce identical hashes. The post notes this combination made the incident less severe for users than it might otherwise have been, though it does not make cracking impossible.

Was this breach linked to any wider pattern the post identifies? Yes. The post notes Dropbox joined a growing list of high-profile breaches at the time, including LinkedIn and Tumblr, where user credentials from years-old breaches were later sold online, indicating that old, unresolved breaches can resurface well after the original incident.

Had the stolen Dropbox files appeared on the dark web at the time this post was published? No. The post states that although the credentials had been obtained via the breach notification service Leakbase, the stolen files had not yet appeared on the dark web and Dropbox had not seen any malicious access of the affected accounts at that point.

Source

• origin post (2016)

Knowledge Base