Dropbox Accounts Breached Through a Flaw in Lenovo's Email Verification

Dropbox has warned some of its users about unauthorized access to their accounts. The cause was a flaw in Lenovo's email verification process that let an outsider register fake Lenovo IDs.

How the attack worked

Dropbox uses Lenovo Identity Provider services as part of its authentication infrastructure — this makes it possible to log into Dropbox using a verified Lenovo ID. The problem is that Lenovo's email verification mechanism allowed a Lenovo ID to be registered against someone else's address. Once he had such a fake identifier, the attacker logged into the Dropbox account tied to that address — no password required.

The key mistake was on Dropbox's side: the account-linking process implicitly trusted Lenovo's claim that the user controlled the address, and did not require additional confirmation through a normal Dropbox login. On top of that, many of those affected had never created a Lenovo ID at all.

Signs and scale

Some users had received notifications of suspicious logins about two weeks ago, immediately changed their passwords and enabled two-factor authentication. One of them noticed something odd: the Dropbox login page had unexpectedly started offering him a “Continue with SSO” option, even though he had never created a Lenovo ID.

According to the investigation, the accounts were accessed between August 4 and August 21. As Reuters reports, around 5,000 accounts were affected, and in some cases the attacker viewed and downloaded content.

The companies' response

In a comment to BleepingComputer, Lenovo blamed the incident on an outdated integration between Lenovo ID and Dropbox that could be used to improperly authenticate some accounts. According to the company, once the problem was discovered Lenovo and Dropbox promptly worked together to eliminate the risk, and Lenovo's own customers were not affected.

Dropbox, for its part, terminated all sessions authorized through Lenovo ID and introduced a new requirement: an attempt to log in via Lenovo ID now requires the Dropbox account password. The investigation is ongoing.

Source: Bleeping Computer