Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Saturday, 1 April, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Dropbox Hacked

An as-yet unidentified hacker has stolen 130 GitHub repositories from the popular file-hosting site

by Guru Writer
November 3, 2022
in News
Dropbox Hacked
Share on FacebookShare on Twitter

Late Monday night, the popular file-hosting site Dropbox announced that it suffered a phishing attack. While no content, passwords or payment information was accessed, the hacker did “successfully access some of the code [they] store in GitHub”. 

The company revealed that on October 14, they became aware that an attacker stole employee credentials, using them to access source code containing “primarily, API keys – used by Dropbox developers”. While it’s currently unclear what those API keys were used for, Dropbox has drawn criticism from API experts for not properly securing their assets. 

 “Static API keys and other important credentials used by app developers should be secured in some manner and not stored in plain text as part of any at rest application source code. Data encryption or leveraging a secure data vault provide two common and more secure alternatives. The Dropbox breach serves as a good reminder for organizations to scan their source code repositories to look for any credentials stored in plain text (API keys, passwords, etc.) that a threat actor could potentially use if they were to gain access to the repository. Additionally, this type of threat illustrates why organizations require runtime API security, which can detect and prevent API abuse if an API key was compromised and used in an API attack,” said Nick Rago, Field CTO at Salt Security, a leading API security provider

Martin Jartelius, Chief Security Officer at Outpost24, pointed out that while Dropbox was fortunate not to lose customer data, it could have been a lot worse. “What we can note here that is positive is that while the user affected had access to repos made available to most developers in the organization, this did not include the core product repositories. The less great part is that both staff and partner personal data were stored in git repositories, hopefully this only relate to contact information relevant to developers, but from the released information this is not entirely clear,” he said, 

Other experts have been quick to note that despite phishing being considered a fairly rudimentary attack method, it’s a popular technique among hackers. “While the impression of hackers is usually of technical geniuses using brilliant attack methods and sophisticated tools to skirt defensive measures, the reality is far from it. A majority of cyber incidents, such as this case, are due to preventable human error or simple methods of attack such as stolen credentials or Phishing,” said Erfan Shabadi, cybersecurity expert at comforteAG. 

Javvad Malik, lead security awareness advocate at KnowBe4, pointed out that this is an example of threat actors finding new ways to bypass MFA. “As MFA adoption increases in popularity, we see criminals adapt their methods to bypass MFA controls by tricking the users in increasingly sophisticated ways. This is why phishing resistant MFA is strongly advised so that social engineering attacks have less likelihood of succeeding. From a technology perspective, this principle of phishing resistant applies beyond MFA and to any system or process a human interacts with. Ultimately though, social engineering is about tricking people, and so, we cannot overlook the importance of timely and appropriate user awareness and training to help them understand the threats that are present, how to identify them, and how to report any suspicious activity,” he said. 

While Dropbox’s security measures have been criticised, the company’s response to the hack has been applauded. “It seems from the outside looking in that Dropbox knows their own weaknesses and have plans they are accelerating to improve identity security and strengthen authentication and authorization. My advice is to keep going, look for single points of failure, be as transparent as you can post incident, as for external advisors post incident even if it’s under NDA, update risk assessments, get those lessons learned, continue to act with customers and partners in mind first and foremost. History will see you as a hero or a villain, never a victim, so make decisions to be the hero,” said Sam Curry, Chief Security Officer at Cybereason.

 

 

 

 

 

FacebookTweetLinkedIn
ShareTweetShare
Previous Post

Is there a problem with stress and burnout in cybersecurity?

Next Post

No time to dwell

Recent News

Data Privacy Day: Securing your data with a password manager

For Cybersecurity, the Tricks Come More Than Once a Year

March 31, 2023
cybersecurity training

Only 10% of workers remember all their cyber security training

March 30, 2023
Pie Chart, Purple

New API Report Shows 400% Increase in Attackers

March 29, 2023
Cato Networks delivers first CASB for instant visibility and control of cloud application data risk

Cato Networks Recognised as Leader in Single-Vendor SASE Quadrant Analysis

March 29, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information