Lenovo ID email verification flaw lets attackers take over about 5,000 Dropbox accounts via legacy login integration
Dropbox confirmed that roughly 5,000 customer accounts were accessed between 4 and 21 August after attackers abused a legacy login integration between Dropbox and Lenovo ID, Lenovo's identity system. Lenovo ID did not verify that a person registering an account actually controlled the email address used. Because Dropbox implicitly trusted Lenovo ID, a Lenovo ID registered with a victim's email address could sign straight into the matching Dropbox account without a Dropbox password. Dropbox told Reuters that fewer than a third of the affected accounts had files accessed. The intrusion was not caught by monitoring at the time and was found only during a later investigation, so affected users were warned weeks later. Lenovo told Bleeping Computer that its own customers and systems were unaffected.
Technical Details
- Root cause: missing email ownership verification during Lenovo ID registration.
- Trust relationship: the legacy Dropbox–Lenovo ID integration accepted a Lenovo ID tied to an email address as sufficient authentication for the Dropbox account with the same address.
- Attack flow: the attacker registers a new Lenovo ID with the victim's email address, then signs into the victim's Dropbox account through the integration, bypassing the Dropbox password.
- No malware or zero-day vulnerability was involved. The article stresses that the attack was unsophisticated.
- Exposure window: 4-21 August, with detection only during a later investigation.
Remediation
- Dropbox terminated all sessions authenticated through a Lenovo ID.
- Dropbox now requires the actual Dropbox password, even when signing in via Lenovo ID.
- Affected users are told to reset their Dropbox and email passwords and enable two-factor authentication (2FA).
- The author recommends enabling 2FA on every service that offers it.
Linha do tempo
-
Lenovo ID email verification flaw lets attackers take over about 5,000 Dropbox accounts via legacy login integration
ler a análise desta fonte ocultar
Dropbox confirmed that roughly 5,000 customer accounts were accessed between 4 and 21 August after attackers abused a legacy login integration between Dropbox and Lenovo ID, Lenovo's identity system. Lenovo ID did not verify that a person registering an account actually controlled the email address used. Because Dropbox implicitly trusted Lenovo ID, a Lenovo ID registered with a victim's email address could sign straight into the matching Dropbox account without a Dropbox password. Dropbox told Reuters that fewer than a third of the affected accounts had files accessed. The intrusion was not caught by monitoring at the time and was found only during a later investigation, so affected users were warned weeks later. Lenovo told Bleeping Computer that its own customers and systems were unaffected.
Technical Details
- Root cause: missing email ownership verification during Lenovo ID registration.
- Trust relationship: the legacy Dropbox–Lenovo ID integration accepted a Lenovo ID tied to an email address as sufficient authentication for the Dropbox account with the same address.
- Attack flow: the attacker registers a new Lenovo ID with the victim's email address, then signs into the victim's Dropbox account through the integration, bypassing the Dropbox password.
- No malware or zero-day vulnerability was involved. The article stresses that the attack was unsophisticated.
- Exposure window: 4-21 August, with detection only during a later investigation.
Remediation
- Dropbox terminated all sessions authenticated through a Lenovo ID.
- Dropbox now requires the actual Dropbox password, even when signing in via Lenovo ID.
- Affected users are told to reset their Dropbox and email passwords and enable two-factor authentication (2FA).
- The author recommends enabling 2FA on every service that offers it.