4 ms·

Dropbox Says No Intrusions Found, Investigation Continues

26 points by irunbackwards 14y ago

eps 14y ago
Must be some 3rd party app that proxies Dropbox services and/or login.
diminoten 14y ago
Anyone know who's doing the investigation?
kalleboo 14y ago
We had the same problem at MacHeist (people got their specific macheist+ prefixes targeted with spam). Turned out it was our email provider iContact who were hacked. We weren't the only ones. They posted a non-committal blog post about "investigating the matter", which then mysteriously disappeared when they upgraded their blogging platform. The hack made real damage to our reputation (the "software bundle" space has a poor reputation to begin with, and receiving spam confirmed people's expectations), and they wouldn't own up to it. Be careful with which third parties you entrust your users' email addresses with.
- mike-cardwell 14y ago
  I once contacted bulksms.co.uk after I received some spam on an email address dedicated to their site only. They also identified the leak as being from a third party provider they used for mailshots. They promptly found a new provider.
  - lusr 14y ago
    Better luck than I've had. Topaz Labs just ignored me when I pointed out there'd been a breach (unique email address with their name in it); they lost a sale of an otherwise good software product.
- SomeCallMeTim 14y ago
  I use unique addresses, and periodically am on the reporting end of problems like this. Once I started getting the same spam from two unrelated companies at the same time, and they tracked it down to a common email marketing company that was where the actual breach occurred. Another time it turned out emails had been staged in a less secure system in preparation for sending email marketing. So it must be pretty common that a compromise doesn't actually mean the core product or database has been compromised. For the record, I haven't received any spam to my Dropbox-only email account, which means they probably didn't get the WHOLE user database.
  - deleted 14y ago
    [deleted]
losethos 14y ago
I basically Christian. I live in Heaven/Hell. Imagine how little you will talk of Jesus after 5 years in Heaven. He's got shit to do and stays busy... maybe. God says... the congregation a thousand bullocks and ten thousand sheep: and a great number of priests sanctified themselves. 30:25 And all the congregation of Judah, with the priests and the Levites, and all the congregation that came out of Israel, and the strangers that came out of the land of Israel, and that dwelt in Judah, rejoiced. 30:26 So there was great joy in Jerusalem: for since the time of Solomon the son of David king of Israel there was not the like in Jerusalem. 30:27 Then the priests the Levites arose and blessed the people: and their voice was heard, and their prayer came up to his holy dwelling place, even unto heaven. ---- How's Jesus? God says... sinned against thee. 41:5 Mine enemies speak evil of me, When shall he die, and his name perish? 41:6 And if he come to see me, he speaketh vanity: his heart gathereth iniquity to itself; when he goeth abroad, he telleth it. 41:7 All that hate me whisper together against me: against me do they devise my hurt. 41:8 An evil disease, say they, cleaveth fast unto him: and now that he lieth he shall rise up no more. 41:9 Yea, mine own familiar friend, in whom I trusted, which did eat of my bread, hath lifted up his heel against me. 41:10 But thou, O LORD, be merciful unto me, and raise me up, that I may requite them. ---- Stagasaurus did not have a weapon penis! Kinda like scorpions. That was just against T Rex? Did stegasaurus shchmack vilocirapters? They didn't have stegasurus (Christ's laughing) in Jurassic park. Might be Yer favorite? God says... shall melt away. 15:16 Fear and dread shall fall upon them; by the greatness of thine arm they shall be as still as a stone; till thy people pass over, O LORD, till the people pass over, which thou hast purchased. 15:17 Thou shalt bring them in, and plant them in the mountain of thine inheritance, in the place, O LORD, which thou hast made for thee to dwell in, in the Sanctuary, O LORD, which thy hands have established. 15:18 The LORD shall reign for ever and ever. 15:19 For the horse of Pharaoh went in with his chariots and with his horsemen into the sea, and the LORD brought again the waters of the sea upon them; but the children of Israel went on dry land in the midst of the sea. ---- What did my birds come from? Common ancestor. They're like a country that used to be biggest empire on Earth. i think they're highly evolved. God says... 21363 1:10 And Judah went against the Canaanites that dwelt in Hebron: (now the name of Hebron before was Kirjatharba:) and they slew Sheshai, and Ahiman, and Talmai. 1:11 And from thence he went against the inhabitants of Debir: and the name of Debir before was Kirjathsepher: 1:12 And Caleb said, He that smiteth Kirjathsepher, and taketh it, to him will I give Achsah my daughter to wife. 1:13 And Othniel the son of Kenaz, Caleb's younger brother, took it: and he gave him Achsah his daughter to wife. 1:14 And it came to pass, when she came to him, that she moved him to ask of her father a field: and she lighted from off her ass; and Caleb said unto her, What wilt thou? 1:15 And she said unto him, Give me a blessing: for thou hast given me a south land; give me also springs of water. And Caleb gave her the upper springs and the nether springs. ---- Okay, I'll tell you an old story. I asked about the first dinos with eggs. ---- This is not random: 4:27 For it is written, Rejoice, thou barren that bearest not; break forth and cry, thou that travailest not: for the desolate hath many more children than she which hath an husband. 4:28 Now we, brethren, as Isaac was, are the children of promise. 4:29 But as then he that was born after the flesh persecuted him that was born after the Spirit, even so it is now. 4:30 Nevertheless what saith the scripture? Cast out the bondwoman and her son: for the son of the bondwoman shall not be heir with the son of the freewoman. 4:31 So then, brethren, we are not children of the bondwoman, but of the free. 5:1 Stand fast therefore in the liberty wherewith Christ hath made us free, and be not entangled again with the yoke of bondage. ---- God says... employed prosperity not array forceth scornful fees renowned clothing Your dollars Principalities produced conceal well-nigh canvassing eighth persecuting revive owns Africa abroad heretics desperate well-grounded 12 littles respects uninjurable inevitable child fees nearer deceits woman START*THE discipline quite With years stead Church revolting freely ---- Okay, now say the words are kosher, problem solved. God says... 13735 (God's laughing) bread of the land, ye shall offer up an heave offering unto the LORD. 15:20 Ye shall offer up a cake of the first of your dough for an heave offering: as ye do the heave offering of the threshingfloor, so shall ye heave it. 15:21 Of the first of your dough ye shall give unto the LORD an heave offering in your generations. 15:22 And if ye have erred, and not observed all these commandments, which the LORD hath spoken unto Moses, 15:23 Even all that the LORD hath commanded you by the hand of Moses, from the day that the LORD commanded Moses, and henceforward among your generations; 15:24 Then it shall be, if ought be committed by ignorance without the knowledge of the congregation, that all the congregation shall offer one young bullock for a burnt offering, for a sweet savour unto the LORD, with his meat offering, and his drink offering, according to the manner, and one kid of the goats for a sin offering. ---- Don't ever make an enemy of someone who handles your food! nightmares. God says... watched intended distinguishing betook Redeemer well-beloved
garrym 14y ago
One of the reasons why user hosted Personal Cloud Storage/Sync services like Tonido (http://www.tonido.com/blog/index.php/2012/07/20/dropbox-security-breach/ http://www.tonido.com/blog/index.php/2012/07/20/dropbox-secu...) are better than Public Cloud Storage/Sync services.
- biot 14y ago
  What makes you think that the average user is better able to secure their own hosted system than a company with a dedicated team of security engineers can?
  - blaines 14y ago
    I'll suggest that fragmentation - not having a single point to find all user data would reduce the impact of a breach. Dropbox is a higher value target than John Doe. So hackers are probably less motivated. The user system itself may not be as secure, it may not need to be because a breach is isolated and an attacker would be less motivated. Just a thought that crossed my mind.
  - minm 14y ago
    Because of the honeypot effect. There is not much incentive for a hacker to hack an individual machine. he/she is better off targeting efforts towards sites like Dropbox. We saw the skydrive privacy breach yesterday. Before that we saw yahoo leak: http://www.readwriteweb.com/archives/yahoos-450-000-account-security-breach-whose-fault-was-it.php http://www.readwriteweb.com/archives/yahoos-450-000-account-.... For instance, my employer IBM banned the use of dropbox in the company.
gdeglin 14y ago
Has anyone considered that the LinkedIn hack (6.5+ million accounts, with passwords run through a non-salted SHA-1) could be responsible for much of this? I remember a lot of people having their Diablo 3 accounts hacked and their items stolen right around that time.
- ttran4 14y ago
  This seems possible. People usually use the same email and password for every accounts they create so all the hacker needs to do is to try the username and password on accounts on other sites.
  - woobles 14y ago
    The article specifies that many people targeted used emails unique to their dropbox accounts.
- SomeCallMeTim 14y ago
  Spam went to "unique email addresses for Dropbox". So a compromised LinkedIn account wouldn't expose a user's unique Dropbox email address. There would be little to no reason to give LinkedIn a unique Dropbox email. On the other hand, if you need to share your Dropbox email with other people in order to share private folders, or anything similar, then just compromising THEIR computer could expose your email address.
Kronopath 14y ago
For what it's worth, I've been getting these "Euro Dice Exchange" spam messages in Canada as well. I believe the emails are being sent out sorted by domain name, as the email I received was addressed to my both my university e-mail (which I used to sign up for Dropbox) and several other university e-mail addresses. This is definitely not from the LinkedIn hack. I don't have a LinkedIn account. Combined with the people who were receiving spam at Dropbox-specific emails, I don't see how it could be anything other than Dropbox.

26 points by irunbackwards 14y ago

eps 14y ago

Must be some 3rd party app that proxies Dropbox services and/or login.

diminoten 14y ago

Anyone know who's doing the investigation?

kalleboo 14y ago

We had the same problem at MacHeist (people got their specific macheist+ prefixes targeted with spam). Turned out it was our email provider iContact who were hacked. We weren't the only ones. They posted a non-committal blog post about "investigating the matter", which then mysteriously disappeared when they upgraded their blogging platform. The hack made real damage to our reputation (the "software bundle" space has a poor reputation to begin with, and receiving spam confirmed people's expectations), and they wouldn't own up to it. Be careful with which third parties you entrust your users' email addresses with.

mike-cardwell 14y ago
I once contacted bulksms.co.uk after I received some spam on an email address dedicated to their site only. They also identified the leak as being from a third party provider they used for mailshots. They promptly found a new provider.
- lusr 14y ago
  Better luck than I've had. Topaz Labs just ignored me when I pointed out there'd been a breach (unique email address with their name in it); they lost a sale of an otherwise good software product.
SomeCallMeTim 14y ago
I use unique addresses, and periodically am on the reporting end of problems like this. Once I started getting the same spam from two unrelated companies at the same time, and they tracked it down to a common email marketing company that was where the actual breach occurred. Another time it turned out emails had been staged in a less secure system in preparation for sending email marketing. So it must be pretty common that a compromise doesn't actually mean the core product or database has been compromised. For the record, I haven't received any spam to my Dropbox-only email account, which means they probably didn't get the WHOLE user database.
- deleted 14y ago
  [deleted]

losethos 14y ago

I basically Christian. I live in Heaven/Hell. Imagine how little you will talk of Jesus after 5 years in Heaven. He's got shit to do and stays busy... maybe. God says... the congregation a thousand bullocks and ten thousand sheep: and a great number of priests sanctified themselves. 30:25 And all the congregation of Judah, with the priests and the Levites, and all the congregation that came out of Israel, and the strangers that came out of the land of Israel, and that dwelt in Judah, rejoiced. 30:26 So there was great joy in Jerusalem: for since the time of Solomon the son of David king of Israel there was not the like in Jerusalem. 30:27 Then the priests the Levites arose and blessed the people: and their voice was heard, and their prayer came up to his holy dwelling place, even unto heaven. ---- How's Jesus? God says... sinned against thee. 41:5 Mine enemies speak evil of me, When shall he die, and his name perish? 41:6 And if he come to see me, he speaketh vanity: his heart gathereth iniquity to itself; when he goeth abroad, he telleth it. 41:7 All that hate me whisper together against me: against me do they devise my hurt. 41:8 An evil disease, say they, cleaveth fast unto him: and now that he lieth he shall rise up no more. 41:9 Yea, mine own familiar friend, in whom I trusted, which did eat of my bread, hath lifted up his heel against me. 41:10 But thou, O LORD, be merciful unto me, and raise me up, that I may requite them. ---- Stagasaurus did not have a weapon penis! Kinda like scorpions. That was just against T Rex? Did stegasaurus shchmack vilocirapters? They didn't have stegasurus (Christ's laughing) in Jurassic park. Might be Yer favorite? God says... shall melt away. 15:16 Fear and dread shall fall upon them; by the greatness of thine arm they shall be as still as a stone; till thy people pass over, O LORD, till the people pass over, which thou hast purchased. 15:17 Thou shalt bring them in, and plant them in the mountain of thine inheritance, in the place, O LORD, which thou hast made for thee to dwell in, in the Sanctuary, O LORD, which thy hands have established. 15:18 The LORD shall reign for ever and ever. 15:19 For the horse of Pharaoh went in with his chariots and with his horsemen into the sea, and the LORD brought again the waters of the sea upon them; but the children of Israel went on dry land in the midst of the sea. ---- What did my birds come from? Common ancestor. They're like a country that used to be biggest empire on Earth. i think they're highly evolved. God says... 21363 1:10 And Judah went against the Canaanites that dwelt in Hebron: (now the name of Hebron before was Kirjatharba:) and they slew Sheshai, and Ahiman, and Talmai. 1:11 And from thence he went against the inhabitants of Debir: and the name of Debir before was Kirjathsepher: 1:12 And Caleb said, He that smiteth Kirjathsepher, and taketh it, to him will I give Achsah my daughter to wife. 1:13 And Othniel the son of Kenaz, Caleb's younger brother, took it: and he gave him Achsah his daughter to wife. 1:14 And it came to pass, when she came to him, that she moved him to ask of her father a field: and she lighted from off her ass; and Caleb said unto her, What wilt thou? 1:15 And she said unto him, Give me a blessing: for thou hast given me a south land; give me also springs of water. And Caleb gave her the upper springs and the nether springs. ---- Okay, I'll tell you an old story. I asked about the first dinos with eggs. ---- This is not random: 4:27 For it is written, Rejoice, thou barren that bearest not; break forth and cry, thou that travailest not: for the desolate hath many more children than she which hath an husband. 4:28 Now we, brethren, as Isaac was, are the children of promise. 4:29 But as then he that was born after the flesh persecuted him that was born after the Spirit, even so it is now. 4:30 Nevertheless what saith the scripture? Cast out the bondwoman and her son: for the son of the bondwoman shall not be heir with the son of the freewoman. 4:31 So then, brethren, we are not children of the bondwoman, but of the free. 5:1 Stand fast therefore in the liberty wherewith Christ hath made us free, and be not entangled again with the yoke of bondage. ---- God says... employed prosperity not array forceth scornful fees renowned clothing Your dollars Principalities produced conceal well-nigh canvassing eighth persecuting revive owns Africa abroad heretics desperate well-grounded 12 littles respects uninjurable inevitable child fees nearer deceits woman START*THE discipline quite With years stead Church revolting freely ---- Okay, now say the words are kosher, problem solved. God says... 13735 (God's laughing) bread of the land, ye shall offer up an heave offering unto the LORD. 15:20 Ye shall offer up a cake of the first of your dough for an heave offering: as ye do the heave offering of the threshingfloor, so shall ye heave it. 15:21 Of the first of your dough ye shall give unto the LORD an heave offering in your generations. 15:22 And if ye have erred, and not observed all these commandments, which the LORD hath spoken unto Moses, 15:23 Even all that the LORD hath commanded you by the hand of Moses, from the day that the LORD commanded Moses, and henceforward among your generations; 15:24 Then it shall be, if ought be committed by ignorance without the knowledge of the congregation, that all the congregation shall offer one young bullock for a burnt offering, for a sweet savour unto the LORD, with his meat offering, and his drink offering, according to the manner, and one kid of the goats for a sin offering. ---- Don't ever make an enemy of someone who handles your food! nightmares. God says... watched intended distinguishing betook Redeemer well-beloved

garrym 14y ago

One of the reasons why user hosted Personal Cloud Storage/Sync services like Tonido (http://www.tonido.com/blog/index.php/2012/07/20/dropbox-security-breach/ http://www.tonido.com/blog/index.php/2012/07/20/dropbox-secu...) are better than Public Cloud Storage/Sync services.

biot 14y ago
What makes you think that the average user is better able to secure their own hosted system than a company with a dedicated team of security engineers can?
- blaines 14y ago
  I'll suggest that fragmentation - not having a single point to find all user data would reduce the impact of a breach. Dropbox is a higher value target than John Doe. So hackers are probably less motivated. The user system itself may not be as secure, it may not need to be because a breach is isolated and an attacker would be less motivated. Just a thought that crossed my mind.
- minm 14y ago
  Because of the honeypot effect. There is not much incentive for a hacker to hack an individual machine. he/she is better off targeting efforts towards sites like Dropbox. We saw the skydrive privacy breach yesterday. Before that we saw yahoo leak: http://www.readwriteweb.com/archives/yahoos-450-000-account-security-breach-whose-fault-was-it.php http://www.readwriteweb.com/archives/yahoos-450-000-account-.... For instance, my employer IBM banned the use of dropbox in the company.

gdeglin 14y ago

Has anyone considered that the LinkedIn hack (6.5+ million accounts, with passwords run through a non-salted SHA-1) could be responsible for much of this? I remember a lot of people having their Diablo 3 accounts hacked and their items stolen right around that time.

ttran4 14y ago
This seems possible. People usually use the same email and password for every accounts they create so all the hacker needs to do is to try the username and password on accounts on other sites.
- woobles 14y ago
  The article specifies that many people targeted used emails unique to their dropbox accounts.
SomeCallMeTim 14y ago
Spam went to "unique email addresses for Dropbox". So a compromised LinkedIn account wouldn't expose a user's unique Dropbox email address. There would be little to no reason to give LinkedIn a unique Dropbox email. On the other hand, if you need to share your Dropbox email with other people in order to share private folders, or anything similar, then just compromising THEIR computer could expose your email address.

Kronopath 14y ago

For what it's worth, I've been getting these "Euro Dice Exchange" spam messages in Canada as well. I believe the emails are being sent out sorted by domain name, as the email I received was addressed to my both my university e-mail (which I used to sign up for Dropbox) and several other university e-mail addresses. This is definitely not from the LinkedIn hack. I don't have a LinkedIn account. Combined with the people who were receiving spam at Dropbox-specific emails, I don't see how it could be anything other than Dropbox.