6 ms·
Dropbox.com hacked?
- general_failure 12y agoIs this real? Scary. How could they get the plain text passwords?
- deleted 12y ago[deleted]
- yen223 12y agoIt could be from reused passwords from prior unrelated password leaks, or it could be a sign of very poor security at Dropbox. My money's on the former.
- nickodell 12y agoPerhaps they obtained the hashes, then tried bruteforcing them, and only published the ones that they actually found.
- codezero 12y agoThe general pattern here is some other large site (or sites) is hacked and their passwords are either not salted, or stored in plaintext, and the people reused the same email/password combo.
- Patrick_Devine 12y agohttp://en.wikipedia.org/wiki/Rainbow_table http://en.wikipedia.org/wiki/Rainbow_table Usually a salt would protect you from that, but look at how trivially easy all those passwords are.
- nitrogen 12y agoBecause of brute force GPU cracking, you need more than a salt. You need bcrypt/scrypt/PBKDF2. Edit: due to the downvote, I'll remind the audience about this: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- wmt 12y agoBy tricking people with a droqbox.com, dropbox.com.77130.cn, "increase your dropbox size" or something similar. At least that would way easier than actually hacking dropbox.
- sidcool 12y agoIf true, this is a big deal. One of the websites has reported that 7 million accounts have been hacked.
- mahmud 12y agoThis is the BIG question.
- shortstuffsushi 12y agoIt would be nice if someone would write a quick script to email these people notifying them. Maybe if I get more time tonight, I'll give it a shot. Otherwise, someone else could be the hero ;)
- sidcool 12y agoI agree, I would like to give it a try. The only problem is how do I ensure the information is valid. I am not going to try and access the accounts, as that would be unethical.
- deleted 12y ago[deleted]
- fiatjaf 12y agoWould it be unethical to enter anyone's house without being invited to save the people in there from a huge fire burning the house?
- vacri 12y agoSaving someone in immediate peril of death is a bit different to alerting someone that there's been a privacy breach, which they can then deal with themselves.
- deanly 12y agoMaybe, but it could definitely be illegal. Anyone could have the right intentions, but make a mistake during an act of Good Samaritan-ship and get sued.
- jxf 12y agoDropbox invalidated the passwords for everyone who's on the list, according to anecdotal reports from people on Twitter. You should change your password anyway, of course. [0]: https://twitter.com/ow/status/521854174007279616 https://twitter.com/ow/status/521854174007279616
- 12y ago
- LeoPanthera 12y agoHas anyone tested those logins to see if they work? Of course, even if they do, it could easily be passwords taken from some other service, matched to accounts where people use the same password for everything. Not necessarily an indication of Dropbox itself being hacked.
- minimaxir 12y agoApparently, yes. http://www.reddit.com/r/sysadmin/comments/2j5xkw/has_dropbox_been_hacked_passwords_dumped_on/ http://www.reddit.com/r/sysadmin/comments/2j5xkw/has_dropbox...
- Q6T46nT668w6i3m 12y agoI tried one earlier. It worked.
- Stormcaller 12y agowhy is hotmail so popular in this list? I thought gmail was the most used and even yahoo seems to go on par with gmail here. May it be because they didn't actually hack dropbox but just hacked about 400 accounts and hotmail users were easier targets because that demographic was more like our parents? Also the list skips from b-e to b-i in 400 users, surely if there were 7 million email addresses this shouldn't be the case?
- dangrossman 12y agoGmail, Hotmail and Yahoo! Mail each have ~300MM uniques per month. Gmail only became the leader, by a percentage point or so, at the end of 2012. You would expect roughly the same number of addresses from each provider.
- deleted 12y ago[deleted]
- untog 12y agoYour tech bias is showing. Gmail is huge amongst techies and the young, but Hotmail and Yahoo are still very, very big e-mail providers.
- sidcool 12y agoTime to buy that external HDD.
- grimlck 12y agoI wonder how many people are foolish enough to store their bitcoin wallets on dropbox, and if the hacker has already preemptively removed the funds from those wallets.
- LeoPanthera 12y ago(Most) bitcoin wallets store the private keys encrypted, so even if you could steal them, they wouldn't do you any good unless the password was very simple.
- newbrict 12y agoI put a money back guarantee that half of the users who do encrypt with a passphrase use the same password that logs into their dropbox account... ha
- sheetjs 12y agoMore teasers: http://pastebin.com/1AZQ7McK http://pastebin.com/1AZQ7McK http://pastebin.com/NtgwpfVm http://pastebin.com/NtgwpfVm
- danso 12y agoChuckling at a few of the passwords of these unfortunate accounts, such as "trustnoone" Considering that Dropbox is most useful via the desktop/mobile app...meaning that the password is rarely entered...I treat my Dropbox password as if it were on a need-to-know basis...that is, I have no idea what it is and I have to jump through several hoops to retrieve it for the rare times when I need to login. I don't put anything too valuable on Dropbox, but better safe than sorry.
- smeyer 12y agoHow rarely would you say you log in to Dropbox? I use it quite frequently to access the website to access files when not on a computer with my full dropbox synced locally.
- calinet6 12y agoAny good password manager (eg: 1Password) has a mobile app for easy access as well. Worth the investment.
- GabrielF00 12y agoOne thing to consider is that Dropbox offers free space for referrals, so there's an incentive for people to create multiple dropbox accounts that they never intend to use. It makes sense that they would choose a very weak password for that account.
- nostromo 12y agoI doubt dropbox was hacked. It also doesn't look like a dictionary attack. It seems more likely that a third-party website wasn't storing passwords correctly, was hacked, and this is the list of users that use a single password for everything.
- pain_perdu 12y agoIf your theory is correct, would we not expect to see the account names be a bit more random? That is to say, these are in alphabetical order and clearly coming from a large list because the letters in each progressive account are similar: Bille97... Billel... Billen... Billet... Billew... Isn't it unlikely that so many alphabetically-similar accounts from the third-party site would use the same password for dropbox?
- yen223 12y agoIt is very likely that they have X million passwords leaked from other sites, and they only chose to release emails that begin with "bi-".
- asdfaoeu 12y agoUsing http://thepiratebay.se/torrent/7803135/1_million_email_list http://thepiratebay.se/torrent/7803135/1_million_email_list to give the relative frequency of email addresses I'd estimate they have a total of around 30k addresses -> % cat 1000000\ email\ list.txt | sed 's/, */\n/g' | grep "@"| sort | uniq | wc -l 835694 -> % cat 1000000\ email\ list.txt | sed 's/, */\n/g' | grep "@"| sort | uniq | grep -i "^b[e-i]" | wc -l 11160 irb(main):001:0> (835694.0 / 11160) * 400 => 29953.189964157707
- kolev 12y agoWhat if the guy created accounts so that people can check those are "real" and collect free bitcoins? Picking similar emails is to try to trick us into believing that he has 7 million of those.
- wrongc0ntinent 12y agoIt's also possible that they have it _all_ and none of the 3 "teasers" are indicative of the complete list. You should assume this is the case if you use dropbox, and act accordingly.
- bobbles 12y agoI've changed my password, but TBH i don't even know if that will help here as they seem to be able to access the passwords as well??
- fiatjaf 12y agoAre people really sending BTC to these guys so they can release "teasers" with so little accounts in pastebins?
- Stormcaller 12y agoNo, they dont, as of yet at least. See: http://btc.blockr.io/address/info/1Fw7QqUgzbns7yWHH32UnmMxmMMwu6MC6h http://btc.blockr.io/address/info/1Fw7QqUgzbns7yWHH32UnmMxmM...
- fiatjaf 12y agoHello everyone, welcome to git-annex, potentially your new assistant for syncing and storing files privately, distributely and cryptographically, as you wish or not: http://git-annex.branchable.com/ http://git-annex.branchable.com/
- voltagex_ 12y agoI backed Joey's campaign for this and made earnest attempts to use it. It's very, very difficult to use for say, backing up MP3s from main machine A to NAS and external drives. Especially on Windows, the sheer number of tiny files it creates causes most tools to grind to a halt.
- bobbles 12y agoIt appears there has been a response from Dropbox: http://www.techly.com.au/2014/10/14/dropbox-hacked-seven-million-leaked-accounts-passwords-go-online/ http://www.techly.com.au/2014/10/14/dropbox-hacked-seven-mil... "Dropbox has not been hacked. These usernames and passwords were unfortunately stolen from other services and used in attempts to log in to Dropbox accounts. We’d previously detected these attacks and the vast majority of the passwords posted have been expired for some time now. All other remaining passwords have been expired as well."
- TTPrograms 12y agoSomebody should compare these against previous major breaches (Adobe etc.). If there was a new one you would think that they would directly name the service. Otherwise they might just be seeking attention / BTC by reposting a previous breach.
- luisrudge 12y agoeasy: https://haveibeenpwned.com/ https://haveibeenpwned.com/
- TTPrograms 12y agoLooks like no, then. Appears to be a new breach of some other service.
- sillysaurus3 12y agoThe website says my gmail address has been pwned: "In September 2014, a large dump of nearly 5M usernames and passwords was posted to a Russian Bitcoin forum. Whilst commonly reported as 5M "Gmail passwords", the dump also contained 123k yandex.ru addresses. Whilst the origin of the breach remains unclear, the breached credentials were confirmed by multiple source as correct, albeit a number of years old. Compromised data: Email addresses, Passwords" Is there some way to figure out exactly which password was compromised?
- 12y ago
- Chris911 12y agoDropbox response: "Dropbox has not been hacked. These usernames and passwords were unfortunately stolen from other services and used in attempts to log in to Dropbox accounts. We’d previously detected these attacks and the vast majority of the passwords posted have been expired for some time now. All other remaining passwords have been expired as well."
- pudquick 12y agoTitle is a bit inflammatory. No proof, simply a few short lists of usernames and passwords that (at the time of release) were valid to login to Dropbox. Did they come from Dropbox? Not necessarily. Not everyone uses a unique username+password combination for each site. A more accurate title would be something like: Dropbox accounts potentially compromised
- msutherl 12y agoDo you have to worry about this if you have 2-factor auth enabled?
- ChrisAntaki 12y agoSo far, it appears not. Though if you reused your Dropbox password anywhere else, resetting both would be a good idea.
- markcampbell 12y agoStep 1. Enable 2 factor authentication Step 2. Change password
- ChuckMcM 12y agoAm I mis-remembering or didn't we see this same list before?
- deleted 12y ago[deleted]
- genesem 12y agoTwo(!) days ago Snowden warned: http://rt.com/news/195244-snowden-rid-dropbox-privacy/ http://rt.com/news/195244-snowden-rid-dropbox-privacy/
- newscracker 12y agoI feel this has been done for the sole purpose of making some money from gullible people (not that making money by finding security holes is bad in itself, as long as it's also combined with some social responsibility). Making unsubstantiated statements like "6,937,081 DROPBOX ACCOUNTS HACKED" and requests like "MORE BITCOIN = MORE ACCOUNTS PUBLISHED ON PASTEBIN" makes this whole thing seem like a scam.
- ASneakyFox 12y agoNo dishonor in scamming fellow criminals I guess.
- harry8 12y agoIs it too controversial to say it's kind of immaterial whether its been "hacked" when the whole thing is a honeypot anyway? http://www.wired.com/2014/04/dropbox-rice-controversy/ http://www.wired.com/2014/04/dropbox-rice-controversy/ Anything you save can and will be used against you ...
- harry8 12y agoAccording to downvoters who don't reply, apparently yes, it is too controversial for HN. On the other hand it's hardly a point of view that lacks legitimacy or goes unheard amongst us. Your private data is not safe in dropbox. The end.
- leke 12y agoInteresting. They wrote a blog post about security and phishing just 5 days ago. I wonder if they already knew about the hack at this time? https://blog.dropbox.com/2014/10/dont-get-baited-by-phishing-or-malware/#more-4034 https://blog.dropbox.com/2014/10/dont-get-baited-by-phishing... I also wonder if this effort was spurred by Snowden's criticism of their system?
- darekkay 12y agoFunny, it actually IS tuesday again :D http://www.eclectide.com/blog/2014/09/14/another-password-leak-oh-must-tuesday/ http://www.eclectide.com/blog/2014/09/14/another-password-le...