Dropbox accounts breached through Lenovo email verification flaw

What happened

Dropbox recently issued a warning to its users regarding a security incident where unauthorized actors gained access to certain user accounts. This breach occurred because attackers successfully exploited a vulnerability in the email verification system of Lenovo, which permitted the creation of fraudulent user profiles. By exploiting this external authentication flaw, the unauthorized parties managed to bypass standard security boundaries and access linked accounts on the cloud storage platform. * Word count check: 72 words.

Although some affected users did not have Lenovo accounts, the cloud-storage provider said it uses Lenovo Identity Provider Services as part of its authentication infrastructure. This allows users to log into Dropbox accounts using verified Lenovo IDs.

How it works

Dropbox’s identity-linking process trusted Lenovo’s assertion that the attacker controlled the email address without requiring confirmation through the existing Dropbox login method. "One odd thing at the time: the Dropbox login page had started offering 'Continue with SSO' for my email even though I never created a Lenovo ID," user xaphod said.

Why it matters

The cloud storage company determined that the attacker accessed users’ Dropbox accounts between August 4 and 21. See the full write-up from BleepingComputer via the source link for quotes and complete context.

Who is affected

Read the original coverage at BleepingComputer via the source link above for the complete details and primary quotes.

What to watch next

Cross-check release notes and official docs before changing production systems based on early reporting.