10 ms·
Dropbox is down
dropbox.com
- minimaxir 13y agoApparently the website has been compromised: https://twitter.com/1775Sec/status/421820685766250496 https://twitter.com/1775Sec/status/421820685766250496 The hackers are also threatening a database leak: https://twitter.com/1775Sec/status/421822727331131392 https://twitter.com/1775Sec/status/421822727331131392 EDIT: Dropbox's statement is that it's maintainance issues: https://tech.dropbox.com/2014/01/dropbox-status-update/ https://tech.dropbox.com/2014/01/dropbox-status-update/ EDIT2: There is a high probability that the Twitter account is faking the hack, due to the "proof" of the hack being taken from an old dump. EDIT3: The account admits they did not hack Dropbox, just DDOSed it. https://twitter.com/1775Sec/status/421848589480910848 https://twitter.com/1775Sec/status/421848589480910848
- citruspi 13y agoThey say they're doing it in honor of Aaron Swartz[0]. (It's the eve of his death). [0]: https://twitter.com/1775Sec/status/421831664239509504 https://twitter.com/1775Sec/status/421831664239509504
- possibilistic 13y agoHow does this honor Aaron? Aaron wouldn't have done something like this.
- deadfall 13y agoIMO it is just an excuse because people are asking why hack them and sending a lot of hate instead of praise.
- middleclick 13y agoWhat a pathetic excuse. Dropbox is loved and used by many people who depend on it. Their behaviour is disgusting nothing more than that.
- citruspi 13y agoHonestly, I'm not sure, and I definitely don't think it's some Aaron would have done.
- infinitebattery 13y agoWell, for one, Dropbox is claiming that it was not a hack at all. See: http://techcrunch.com/2014/01/10/dropbox-offline-hacker-group-claims-credit/ http://techcrunch.com/2014/01/10/dropbox-offline-hacker-grou... and also see dropbox's blog post, explicitly stating that it "was caused during routine internal maintenance, and was not caused by external factors" https://tech.dropbox.com/ https://tech.dropbox.com/
- citruspi 13y agoYeah, I saw the article on TheNextWeb after posting my comment, but I figured I'd leave it up. Either way, I'm happy to hear that Drop Box wasn't compromised.
- taternuts 13y agoIt's a ridiculous claim.... they want more publicity. Dropbox has done nothing to warrant this attack for 'activism'. Let's hope they don't leak sensitive information if Dropbox reaches out to them and fixes the issue - that would especially be something Aaron wouldn't do.
- ewang1 13y agoThey also apparently took down the CA DMV site today.
- 0x20 13y agoHaha, seriously? Did you really have to use a "citation" for a twitter link in your 10 word comment?[0] Pretentious pseudo-scientific nonsense. Only on hacker news. [0]: No.
- citruspi 13y agoFor what it's worth, I write most things in Markdown and I use reference style links[0] by default. So, I tend to do that in comments on Hacker News, but I omit the brackets which would go around the link "value," (i.e. the inner value of the a tag in HTML). Plus, by listing the links under the comment, I find that it's neater and easier to read. And by simply including the links (even if it's just for "a twitter link" in my "10 word comment") it saves other people time because they don't need to search for it themselves. [0]: http://daringfireball.net/projects/markdown/syntax#link http://daringfireball.net/projects/markdown/syntax#link
- InclinedPlane 13y agoI'm thankful there are so many folks out there still doing this sort of thing for "fun" or pure mischieviousness. Imagine how much worse it could be if they tried to be as stealthy as possible, got people downloading a hijacked dropbox service, etc. Edit: which isn't to say this sort of thing is awesome, but it's a damn sight better than the alternative. These sorts of pranksters are like cow pox, and hopefully they encourage resistance to the real deal.
- jrochkind1 13y agoso, so, true. Every time a serious hack-and-reveal happens, I wonder how many times it's _already_ happened, by someone who kept it quiet for their own continued use.
- InclinedPlane 13y agoI'm reminded of the gawker attack. So much information was revealed to the attackers unwittingly and they had no clue they were hacked, it could have been so much worse, bank accounts could have been drained, sites could have been used to host exploits or malware, etc.
- yeukhon 13y agoPathetic people spreading false news. We should shame them publicly. Anyone putting up false news is as guilty as, as shameful as, as fucked up as, as stupid as anyone sabotage security on purpose secretly. We have enough stupid political propaganda full of false statements in the news these days and we don't need more in our tech community on Twitter. What are they? 12 years old? Right, they say "don't feed the trolls."
- evan_ 13y ago> We should shame them publicly Don't give them any more attention.
- motyar 13y agoWhen a big site is down, Tweet this:- We have just compromised the @sitename Website [siteLinkHere] #hacked #compromised
- nodesocket 13y ago"We are aware that the Dropbox site is currently down. This was caused during routine internal maintenance, and was not caused by external factors. We are working to fix this as soon as possible. We apologize for the inconvenience."
- middleclick 13y agoI am sure the people who did this must be "very proud" of themselves but there can be no justification for hacking something as innocuous as Dropbox.
- zacinbusiness 13y agoIt was only a matter of time. So many people use DB. Still, I'll keep supporting them.
- dshibarshin 13y agoProbably just maintenance issues https://twitter.com/alicetruong/status/421834839721922560 https://twitter.com/alicetruong/status/421834839721922560
- aroch 13y agoIf indeed the twitter spewings are correct and they've gained access to the database, I suppose now is the time to see how Dropbox secures passwords and user details.
- pablosanchez 13y agoDropbox Status Update: https://tech.dropbox.com/2014/01/dropbox-status-update/ https://tech.dropbox.com/2014/01/dropbox-status-update/
- username223 13y ago> We are aware of an issue currently affecting the Dropbox site. We have identified the cause, which was the result of an issue that arose during routine internal maintenance, and are working to fix this as soon as possible. We apologize for any inconvenience. Comments are now, of course, closed. Whew, that's reassuring!
- moonka 13y agoClearly they have seen the twitter account claiming responsibility as well. It's been changed a little. >We are aware that the Dropbox site is currently down. This was caused during routine internal maintenance, and was not caused by external factors. We are working to fix this as soon as possible. We apologize for the inconvenience.
- username223 13y agoI almost feel sorry for the PR automata having to produce this BS on a Friday night. Compared to Target's multi-billion-dollar gift to credit card thieves, this is nothing.
- tristessa 13y agohttp://thenextweb.com/insider/2014/01/11/dropbox-is-down-due-to-routine-maintenance-issue-not-security-breach/ http://thenextweb.com/insider/2014/01/11/dropbox-is-down-due...
- legacy2013 13y agoThis is stupid. Leaking the database will compromise users, which may hurt the company a bit, but will hurt the common person more. Its a pointless hack that won't accomplish much more than just reporting the bug would.
- kapkapkap 13y agoIts important to note this is not merely their website. All data between dropbox folders/clients is not being synced.
- chrislaco 13y agoNot only not being synced.. I'm also seeing some files being much older than what they used to be.
- rlu 13y agoEither hackers took it down and Dropbox is lying on their status page, or Dropbox did routine maintenance and Anonymous is taking false credit. Unfortunately, I find option #1 to be more likely.
- el_duderino 13y agoProbably. But due to how huge they are now, I don't blame them for trying to pass this off as a routine maint thing. Shit's either going to blow up or will be OK.
- pervycreeper 13y ago>Dropbox is lying on their status page They're saying it's an issue that "arose during routine maintenance", so that doesn't preclude the possibility they had inadvertently exposed a security vulnerability by doing that, leading to it then being exploited.
- cgrubb 13y agoI haven't seen any proof from the hackers. The emails in the pastbin from @1775Sec are old. They are in this pastebin from a month ago: http://pastebin.com/64PAAV1c http://pastebin.com/64PAAV1c
- ballstothewalls 13y agoI find it humorous how you are more likely to trust the word of some blackhat organization over that of an established company with a reputation that it needs to uphold. Lying would hurt it eventually. Also, the hackers admitted that they only DDOS'ed the website and made up the bit about the database leak. https://twitter.com/1775Sec/status/421852503848656898 https://twitter.com/1775Sec/status/421852503848656898
- spydum 13y ago<tinfoil>Surely the NSA has nothing to do with this... </tinfoil>
- jrochkind1 13y agoIf the NSA had something to do with it, odds are we wouldn't know about it to ask if the NSA had something to do with it.
- code_duck 13y agoWe've heard that several large Internet companies were angered that their networks were tapped by the NSA for surveillance, and subsequently put a lot of effort into securing them with encryption. While it seems unlikely, it's conceivable that this has something to do with a response to surveillance, such as problems encountered while implementing encryption.
- gtklocker 13y agoThey're stating they have a partial DB leak. https://twitter.com/1775Sec/status/421842856748126208 https://twitter.com/1775Sec/status/421842856748126208
- middleclick 13y agoSeems like just names and email addresses.
- fyrabanks 13y agoYeah, this is terribly easy to fake. Also, if you look closely, they repeat a lot of the same e-mail addresses with different "real" names attached to them. e.g., flyman@gmail.com and kidrock@msn.com (which appears right next to each other...)
- dclara 13y agoI noticed it too. But it does not quite make sense, because nobody likes to sign up twice using different email address immediately, even if they don't remember their password. This reminds me that the exposed the data might be fake too.
- deleted 13y ago[deleted]
- sandworm101 13y agoI call fake. See http://pastebin.com/64PAAV1c http://pastebin.com/64PAAV1c Same data, one month old.
- middleclick 13y agoNice find. Someone should tweet this out.
- fieryscribe 13y agoIt's a compromise: https://twitter.com/1775Sec/status/421842856748126208 https://twitter.com/1775Sec/status/421842856748126208
- dclara 13y agoIt's unbelievable to realize that the Yahoo or Google never experienced such accident. This is not the time for maintenance. Failover is the key, production should have hardware load balancing to switch to, right? Actually the front end should not be affected with the backend, unless the entire website is compromised.
- polarix 13y ago...which isn't to say that decentralized services are mandatory for the continued health of humanity, but...
- dclara 13y agoI'm totally with you. This is such a critical point, probably not attracting enough people's attention yet. In order to achieve real robustness with high availability, clustering is not enough. Distributed computing architecture is the next hot topic we are going to bring up. Check out the blog page: http://bingobo.info/blog/bingobo/sql-or-nosql-and-search-engine-solutions.jsp http://bingobo.info/blog/bingobo/sql-or-nosql-and-search-eng...
- motyar 13y agoUse IP http://108.160.166.62 http://108.160.166.62 Seems DNS problem. Update: Dropbox app seems working well after adding this like to /etc/hosts 108.160.165.62 dropbox.com
- dclara 13y agoIs this the latest website or cached somewhere? Look different though. I don't quite believe that DNS would be hacked. I was thinking that they should quickly point the DNS to a different front end server to avoid this type of unavailable. Guess they are doing their job.
- aroch 13y agoit is their IP, and it looks like their vaguely-newish home page redesign [0]: http://dns.squish.net/traverses/df9a8b86bde047a12801bc04c96eedae http://dns.squish.net/traverses/df9a8b86bde047a12801bc04c96e...
- motyar 13y agoI tried ping dropbox.com and got this IP Not sure about other things. For sure not a phishing, but seems SSL problem for IP.
- dmourati 13y agoSeems working now.
- Urgo 13y agoJust as a random update, I've been monitoring this thread & twitter etc since the beginning and it appears that dropbox is sort of working now just on extreme delay. I have auto upload on my phone and it took about 14 minutes for the picture I took to get synchronized with my desktop (normally its almost instant).
- dbloom 13y agoFor everyone linking to a certain Twitter account saying that Dropbox is compromised: The Twitter account is lying. This is almost always the case (especially when there is some sort of Anonymous affiliation). Anyone can make a Pastebin of fake emails. (If Dropbox actually gets hacked, it's more likely to be by a state-sponsored organization, and definitely not by someone who is going to brag about it on Twitter)
- vanmount 13y agoIt's just a DDoS Attack according to them
- kategleason 13y ago:(
- wanda 13y ago@1775Sec You only DDoS attacked them! You didn't breach the database! Why say otherwise!" @YourAnonPriest don't ruin the suspense brother! lol it was a pretty massive DDoS too! We used all of our bots on it! https://twitter.com/1775Sec/status/421848589480910848 https://twitter.com/1775Sec/status/421848589480910848
- tlrobinson 13y agoI love Dropbox, but a distributed solution like BT Sync or AeroFS is looking more attractive.
- slipszenko 13y agoI've made this so you can be notified by SMS when the dropbox API is working again: http://isdropboxback.slipszenko.net/ http://isdropboxback.slipszenko.net/
- andydevo 13y agoI think I have proof that it was compromised, and it's not just maintenance. Has this been confirmed? I'm thinking of writing a blog about it?