Dropbox has begun telling some of its users that a stranger was able to get into their accounts last month without ever knowing their password. The way in was not Dropbox's own login but a second door that most of those users did not know existed: the option to sign in with a Lenovo ID.
According to the notice sent to affected customers, a weakness in the way Lenovo checks email addresses made it possible to register a Lenovo ID under somebody else's address. Dropbox accepts Lenovo as an identity provider, so whoever held that Lenovo ID could then sign in to the Dropbox account registered to the same address. The company says the unauthorized access took place between August 4 and August 21.
Some of the people who received the notice have never owned a Lenovo account. The attacker did not take over an existing identity. They created a new one in the victim's name, and Dropbox treated it as proof of who they were.
Where the trust broke down
Signing in through a third party works on a simple promise. The identity provider tells the service that the person in front of it controls a given email address, and the service believes it. That promise is only as good as the check behind it. If the provider lets someone finish registration without proving they can read mail sent to the address, every service that relies on its word inherits the weakness.
The second half of the problem sat on Dropbox's side. When a Lenovo ID turned up claiming an email address that already belonged to a Dropbox account, the two were linked without asking the existing account holder to confirm through their normal login. A password prompt at that moment would have stopped the attack even with Lenovo's verification broken.
Dropbox has now added exactly that. It says it expired every session that had been authenticated through a Lenovo ID, removed the Lenovo connection from the affected accounts, and now insists on the Dropbox password before a Lenovo ID will be accepted for any of them.
Some of the affected users have said publicly that the first sign of trouble came about two weeks before the notice, when Dropbox warned them of a suspicious sign in. One noticed that the login page had started to offer a single sign on option for an email address that had never been connected to anything of the kind.
What affected users should do
Dropbox's notice does not say how many accounts were involved. Neither company had published a public advisory as of Wednesday, which leaves customers who did not get an email with no easy way to confirm they were unaffected. For anyone who did receive one, the sensible steps are these:
- Change the Dropbox password, and the password of the email account tied to it.
- Turn on two step verification.
- Look through the list of active sessions, linked devices and connected apps, and remove anything unfamiliar.
- Check the account's activity history for logins, downloads or shared links from the first three weeks of August.
Administrators elsewhere may want to look at which outside identity providers their own services accept. Sign in integrations added years ago for a hardware bundle or a marketing partnership tend to stay switched on long after anyone remembers them, and each one is another party whose verification process has to be trusted.
