Hackers Stole Account Details for Over 60 Million Dropbox Users 66
The Dropbox hack is more severe than we expected. Motherboard has the details: Hackers have stolen over 60 million account details for online cloud storage platform Dropbox. Although the accounts were stolen during a previously disclosed breach, and Dropbox says it has already forced password resets, it was not known how many users had been affected, and only now is the true extent of the hack coming to light. Motherboard obtained a selection of files containing email addresses and hashed passwords for the Dropbox users through sources in the database trading community. In all, the four files total in at around 5GB, and contain details on 68,680,741 accounts. The data is legitimate, according to a senior Dropbox employee. Security expert Troy Hunt has corroborated on Motherboard's claims, and has updated Have I Been Pwned website where you can go and see if you're among one of the victims.
Re: (Score:1)
But..but..is a password app luddite or not?!!?
Mind blown.
Re: (Score:2)
All of this, mod it up. I have Dropbox and just changed my password anyways, even though they say I wasn't part of the hack. It's a good thing to do every year or so anyhow, because not all hacks get noticed and reported.
cloud services: dumb idea (Score:2)
How about: live by the cloud, die by the cloud. Or, trust someone else with your data, and just consider it pre-shared.
Re: (Score:2)
I mostly use Dropbox as an extra external backup, which is conveniently also easy to share with others without having to host anything myself. Certainly not as mission critical primary storage, or for sensitive documents. Mine is mostly full of family pictures and videos that we all share with each other. Nothing business related, and nothing that would be potentially compromising if it were to be lost and/or stolen.
Whatever your usage, and however trivial the website is,
Re: (Score:2)
Old XKCD [xkcd.com]
For some reason we haven't found a way to transfer files well yet.
Or we have, but most people just don't want to use it.
Matter of Time (Score:1)
Was just a matter of time. It's why I was adamantly opposed to anyone putting this on a business workstation. Dropbox was never HIPAA compliant.
Re: (Score:2)
I got a telemarketer calling me and a dozen other people at my work trying to convince us to purchase what he called a dropbox integrator for citrix.
Then half an hour later I saw this story. I just wish I had seen this first so instead of politely telling him to go away I could have just laughed until he hung up.
One must wonder... (Score:2)
Is there anyone who uses the Internet that has NOT been affected by a malicious hack?
Let's just make everything easy and all use the password 12345.
That's the smartest password I've ever heard of in my life! That's the kinda thing a genius would do ... I've got the same combination on my luggage!
Re: (Score:3)
LastPass breach, 2015 [lastpass.com]
Re: (Score:2)
... I've got the same combination on my luggage!
I don't bother with locks on my luggage anymore. TSA just cuts them off -- even the "TSA approved" locks they have a key for -- as would anyone who wants to break in.
Re: (Score:2)
Re: (Score:2)
Plenty, unless you count failed attacks that are the persistent background noise of the net.
Dropbox however have been exceptionally, indeed hilariously incompetent with security at times - which makes them "special".
For some time people were treating it as a high speed bittorrent replacement - if you knew the hash and filename of somebody else's file you could get it from dropbox. So you could go to the pirate bay, find th
I'm curious (Score:1)
What about those accounts that used Google to log into dropbox? I've seen an increase in that lately, sites using services like Google or Facebook to log in users.
Just for the record... (Score:5, Informative)
Re: (Score:3)
And if we're going to go there: you can't be "among one of the victims", you' could be either among the victims or one of the victims.
Re: (Score:2)
It's also missing an article 'the' or a possessive 's' from the sentence snippet "and has updated Have I Been Pwned website"
Re: (Score:2)
And if we're going to go there: you can't be "among one of the victims", you' could be either among the victims or one of the victims.
Well, one of the victims could be spread out over a large area, and could be among it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Possible misuse of "collaborate"? We certainly "collaborate on" projects.
Is this website legit? (Score:4, Interesting)
Re:Is this website legit? (Score:5, Informative)
Extremely legit, Troy Hunt goes to great lengths to ethically report breaches, hiding "sensitive" results (so you cant search someones email to see if they were an Maddison Ashley account holder, for example) as well as verifying a dataset is authentic (there are fake ones going around).
You should sign up to that site immediately, if you havent already. You get email notifications if a new breach includes your email address, which is worth it alone.
Re: (Score:2)
Urgh, thats Ashley Madison, the dating site for people wanting to have affairs...
Re: (Score:2)
Re:Is this website legit? (Score:4, Informative)
Is it possible that your email account was previously used by someone else, or that someone else signed up under your account?
Also not all the data necessarily pertains to log in account data. Perhaps your email address was a backup contact address, a friend's contact, referral, etc. There's lots of ways some basic information about you could be "compromised" with an data breach even if you never had an actual account.
Re: (Score:2)
Same here, my e-mail address is showing as "pwned" for Gamigo, a German online publisher which I never heard of.
Re: (Score:2)
Most likely, yeah.
database trading community? (Score:2)
Motherboard obtained a selection of files containing email addresses and hashed passwords for the Dropbox users through sources in the database trading community.
What the hell is the database trading community?
Grain of salt (Score:2)
Re: (Score:1)
Same for me. I've never had a myspace account, but the junk email I checked was part of that compromise. Could be other spammers registering accounts with my email though, as I've seen that happen no less than 5 times with my email address being used to create junk Facebook accounts. They are never fully activated because they can't get the verification email, but it still creates a partial account which generates junk activity emails, which is very annoying. Part of the reason I am changing to a new email
Re: (Score:2)
He doesn't actually ask for donations. He provides a way to donate because people have repeatedly expressed strong desires to donate to the project for the service they receive. He doesn't mince words on the time investment required, though.
Why donate?
Ok, so donations. Many people love this service and to my surprise, many have actually asked to donate. In all good conscience, I can't on the one hand write about how awesome and cost effective Azure is then on the other hand ask for donations to fund it. It's cheap — I've got it covered.
Let me instead talk about the sacrifices required to make a service like this work. It can be enormously time consuming and that's the real cost here. Plus there are a few services I pay for out of my own pocket to make the magic happen. If you want to kick in to help me cover those costs, that would be awesome. And no problem if you don't want to either; just share the love and help others make use of the service.
Re: (Score:3)
Just for giggles I went there and put in my throw away email that I use to register to crap. apparently I was "pwned" in the myspace hack. Funny thing is I've never had a myspace account. Ever. i'm not calling bullshit, but when the site tells me I'm owned and asks for a donation, I'm going to question it. But I know 100% I have never registered a myspace account.
And you're sure that you've been the only person to own that email address? My throw away email address got leaked in a hack and someone used it to sign up for an instagram account without my knowledge or consent. I get emails from Instagram all the time saying that there is suspicious activity associated with the account i never created. So one day I went to instagram and did the password recovery on that throw away account and, sure enough, they let someone create and use an account without me ever au
Re: (Score:2)
I have my own domain which I use for email. One very unpleasant week a spammer decided to use my domain name to allegedly send email from, using a very large numbers of fictitious accounts in that domain. I was hit with something on the order of four thousand backscatter spam messages in one day. If you have a first name that's not too rare in the US, there has been at least one email sent with your name @ my email domain.
Re: (Score:2)
This is why I don't trust cloud storage. (Score:1)
Oh no, I've been pwned! (Score:2)
Those dasterdly demons. According to 'Have I Been Pwned', I've been pwned on three sites that I've never visited. Surely that requires some very sophisticated hacking. I was offered more detailed information in return for a donation/subscription.