Imagine backing up your sensitive data on Dropbox and one fine morning, finding out that your password has been leaked or you are locked out of your account and cannot access any of your files. These nightmarish scenarios are not entirely unlikely, seeing how inviting cloud storage sites are to security breaches. In this article, we will discuss:
-
Whether Dropbox has ever been hacked? -
What Dropbox does to protect your account? -
What you can do for security against hacks and ransomware?
Hack Attempts on Dropbox:
Cloud storage sites host a huge amount of data, which makes them very attractive to attempts at illegal access. It seems Dropbox isn’t impervious to them either. Two major incidents occurred in 2012 and 2014 respectively, in which Dropbox account details were compromised. Post the hacking attempt in 2012, in which usernames and passwords were leaked, Dropbox commented that these passwords were not stolen from them but from third party websites and were then used for log in attempts to Dropbox accounts. It actually came to light in 2016, the extent of that hack. Details of over 68 million accounts were compromised and contained in a 5GB file. This file was acquired by Motherboard and its legitimacy was confirmed by an anonymous senior Dropbox employee. Following this, the company enforced a large number of password resets and later confirmed that all the accounts associated with the leaked details had been secured and no private files were accessed.
In 2014, another hacker posted credentials of about 400 Dropbox accounts to Pastebin, an online content hosting service and claimed they would follow up with almost 7 million more in return for bitcoin donations. The hacker’s initial post was followed up with a few hundred more credentials. While the first 400 were confirmed to be associated with Dropbox, the rest were not. Again, the company claimed that they were not hacked. The 400 stolen passwords were not taken directly from them but from unrelated services and were being used to log in to Dropbox accounts. They stated that their security measures detected fishy activity on the compromised accounts and automatically called for password resets.
How Dropbox Protects Its Accounts?
Being so prone to security threats, it is obvious that a website like Dropbox has to take extensive security measures to protect the data of its trusting users. Following are some of the steps that they take to ensure that their accounts are not corrupted:
Password Hashing and Salting:
Dropbox uses strong hashing functions to protect passwords. A hashing function is an algorithm that almost irreversible changes the password you enter into a different output called a hash digest. Almost irreversible implies that it is very hard to go back to the original password from the digest. All the passwords are stored in files in the form of hash digests instead of plain text. If anyone gains access to these files, they will not get their hands on the passwords but instead to the hash digests, which cannot be used to access associated accounts. Hence, despite the massive security breach of 2012, the very reason that many of the users’ files were not compromised is precisely that the hackers got their hands on the hash digests instead of the actual passwords. As an extra strengthening step, a random string, called a salt, is also added to the hashed password, making it harder to crack. Since 2012, Dropbox keeps updating its hashing practices and uses strong algorithms like bcrypt.
Monitoring Systems:
Dropbox also has an automatic monitoring system in place that can detect threats or suspicious activity, given the name of Securitybot. Sometimes, hackers try to access accounts through brute force algorithms, the only solution to cracking a hashed password. These algorithms use computational power to try, for example, all possible words in a dictionary until they hit jackpot. The detector being the first line of defense, can register such attempts and promptly call for a response such as a password reset. It also alerts the security team of any threats.
Encryption During Transfer:
When your data is sitting in the cloud, it is protected by encryption. Encryption scrambles data into gibberish so that it cannot be understood by anyone who doesn’t have the key to reverse the scrambling process. If anyone taps into your files, they cannot make any sense of the data. Data can also be vulnerable while it is being transferred to the cloud as internet connections can be tapped. In order to prevent this, Dropbox uses certain protocols that allow users and Dropbox to authenticate each other before communication and maintain confidentiality whilst communicating.
Data Logs:
In order to keep track of file activity, Dropbox keeps a log which can be viewed by you. In case a file goes missing, you can check against this log as to when it was moved.
Why would someone hack your Dropbox account?
There are plenty of reasons why someone would hack your Dropbox account. Hackers enjoy to hack these monster site users and use it to extortion. They may share your private data on social media sites and ask you to pay money to get it removed.
Back in the day, when Dropbox referral program was on its peak, some hackers would hack other Dropbox accounts to just extra free space. Even though, there were other techniques available to do it properly.
What You Can Do for Maximum Security:
To make sure at your own end that your account is secure, set a good password. Dropbox recommends users to not use a single password across multiple sites because it cannot vouch for the security of these other sites. In case they are breached, hackers can get their hands on your password and use it to access your Dropbox account too. In fact, as mentioned before, this is what the company claimed happened in the hacking attempts of 2012 as well as 2014. Also, in order to avoid brute-force attacks, it is advisable to not use common words or phrases in your password as these can be easily guessed.
They also recommend turning on the two-step verification process. In addition to your password, this process requires you to enter a code that is sent to you through phone or email before logging you in. This might make login a little less convenient, but it ensures more security.
What About Ransomware?
Ransomware is a type of malware that locks users out of their accounts and demands ransom in return for restoring their access. Dropbox accounts can be susceptible to such attacks for the simple reason that they are very easy to execute. Ransomware can easily be slipped into seemingly innocuous files, and cannot be differentiated from normal files by applications.
While Dropbox isn’t invincible to ransomware it does offer data backups to combat such issues. Through this feature, files can be restored to a date prior to the ransomware attack. A restoration of as far back as 30 days is free. If a user wants to go back even further, they can sign up for a paid subscription plan. While ransomware attacks might be really difficult to filter, this feature still allows you to incur as little a data loss as possible.
Learn more about Ransomware here
Have something to ask???? Please ask in comments or contact us.
Follow us on Facebook, Google Plus and Twitter.
