Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Dropbox admits it suffered serious password failure

Drops authentication for four hours

Article comments

Cloud file synchronisation company Dropbox has admitted that it suffered a serious security lapse that allowed an unknown number of users to log into any account using any password.

In a blog post, Dropbox said that for four hours on the afternoon of 20 June (US Pacific Time) a bug in its authentication system would have allowed some users to log in "without the correct password.”

“A very small number of users (much less than 1 percent) logged in during that period [...]. As a precaution, we ended all logged in sessions,” the blog said.

“We’re conducting a thorough investigation of related activity to understand whether any accounts were improperly accessed. If we identify any specific instances of unusual activity, we’ll immediately notify the account owner,” it added.

The issue was publicised on the Pastebin forum by Dropbox nemesis Christopher Soghoian, the same freelance researcher who recently made a complaint to the US Federal Trade Commission (FTC) over potential weaknesses in the company allowing some employees access to the encryption keys used to store customer files.

Dropbox’s characterisation of the matter could turn out to be an understatement of what looks like a huge if temporary lapse in security.

Security company Tenable Network Security has advised that Dropbox should used with caution by companies, preferably only with files that have first been encrypted.

“Organisations need to have policies in place to authorise, prevent and/or audit the use of services such as Drop Box,” said Tenable’s CEO, Ron Gula.

“If the file shared via Drop Box was encrypted, Dropbox security may not be an issue. However if the file shared via Drop Box was an employee or customer spread sheet, then any security issue with Dropbox could result in the disclosure of this sensitive information,” he said.

Despite its recent problems, the service is still hugely popular with its customers, which use it as a convenient way to store files in folders which are then automatically mirrored to all other devices on which the same software is installed.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *