Dropbox Admits it Suffered Serious Password Failure

Cloud file synchronisation company Dropbox has admitted that it suffered a serious security lapse that allowed an unknown number of users to log into any account using any password.

In a blog post, Dropbox said that for four hours on the afternoon of 20 June (US Pacific Time) a bug in its authentication system would have allowed some users to log in “without the correct password.”

“A very small number of users (much less than 1 percent) logged in during that period […]. As a precaution, we ended all logged in sessions,” the blog said.

“We’re conducting a thorough investigation of related activity to understand whether any accounts were improperly accessed. If we identify any specific instances of unusual activity, we’ll immediately notify the account owner,” it added.

The issue was publicised on the Pastebin forum by Dropbox nemesis Christopher Soghoian, the same freelance researcher who recently made a complaint to the US Federal Trade Commission (FTC) over potential weaknesses in the company allowing some employees access to the encryption keys used to store customer files.

Dropbox’s characterisation of the matter could turn out to be an understatement of what looks like a huge if temporary lapse in security.

Security company Tenable Network Security has advised that Dropbox should used with caution by companies, preferably only with files that have first been encrypted.

“Organisations need to have policies in place to authorise, prevent and/or audit the use of services such as Drop Box,” said Tenable’s CEO, Ron Gula.

“If the file shared via Drop Box was encrypted, Dropbox security may not be an issue. However if the file shared via Drop Box was an employee or customer spread sheet, then any security issue with Dropbox could result in the disclosure of this sensitive information,” he said.

Despite its recent problems, the service is still hugely popular with its customers, which use it as a convenient way to store files in folders which are then automatically mirrored to all other devices on which the same software is installed.