Dropbox blames staffer’s password reuse for spam flood breach
Web attic Dropbox has admitted spammers got hold of its users’ email addresses after an employee reused their work password on a website that was subsequently hacked.
Suspicions of a breach at the online storage service arose two weeks ago when punters received floods of unwanted messages touting gambling sites at addresses they used exclusively with their Dropbox accounts.
The company launched an investigation, which confirmed these suspicions were well-founded. Most of the blame was levelled at an unnamed employee who reused his or her Dropbox password for an account on a third-party website that was compromised.
Hackers used the stolen credentials to raid the staffer’s online locker, and found a document containing Dropbox usernames and registered email addresses. The company stated:
Our investigation found that usernames and passwords recently stolen from other websites were used to sign in to a small number of Dropbox accounts. We’ve contacted these users and have helped them protect their accounts.
A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses. We believe this improper access is what led to the spam. We’re sorry about this, and have put additional controls in place to help make sure it doesn’t happen again.
Dropbox failed to say how many account records had been compromised, stating that its investigation remains ongoing. In the meantime it has promised to introduce tougher security controls such as optional two-factor authentication systems for logins, “new automated mechanisms to help identify suspicious activity” and systems to force users to retire passwords that are weak or haven’t been changed in ages. ®
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/01/dropbox_breach/