advice
Earlier this week, my colleague Chris from Threatpost penned an article about how Dropbox forced a password reset for users who had not changed their passwords since 2012. At the time of his post, Dropbox called the move “purely a preventative measure.”
Back in 2012, Dropbox was the victim of a security breach that caused headaches and spam for users of the service. Four years later, the full extent of the breach is now coming to light after a cache of Dropbox user credentials was discovered online. Last night, Motherboard reported that the databases making their way around the database trading community were real and comprised more than 68 million Dropbox accounts.
In the post, Motherboard noted that Dropbox had not seen evidence of malicious account access. Of the 68 million-plus accounts, approximately 32 million are secured with bcrypt; the rest are hashed with SHA-1.
What does this mean?
According to Motherboard’s report, the Dropbox data dump is not currently listed on the major dark web marketplaces, presumably because when passwords are adequately secured, their value to criminals diminishes. Given that this story is still developing, I suggest keeping tabs on Threatpost; they’ll have rapid coverage should things change.
What should you do?
In the grand scheme of things, this breach is just another one to add to the ever-growing list of data dumps from megasites. It joins LinkedIn, MySpace, Tumblr, OKCupid, and Spotify (x2), among others. Criminals find value in account credentials, and we know that hackers are gonna hack, so what we need to do as citizens of the digital world is to be smarter about how we secure our digital lives. As with any major breach, we will bang the drum on five essential tips for online security:
1. Use strong passwords and change them regularly. Can we all agree that keeping the same password for four years is not a good idea? Beyond that, passwords should both be easy to remember and strong (for an exercise in creating strong passwords, try our password check tool).
Also, for tips on creating secure but memorable passwords, please see http://t.co/Q6qWwHUF9v #carphonewarehouse #Kaspersky #securepasswords
— David Emm (@emm_david) August 10, 2015
It is also a good rule of thumb to change your passwords regularly on vital sites. Think online banking, Facebook, LinkedIn, and your primary personal e-mail. If the thought of creating, changing, and remembering all of your passwords seems daunting, consider using a password managing tool such as Kaspersky Password Manager.
2. Delete old accounts. When we reported on Myspace in May, a common piece of snark on our internal chat was, “Wait, people still use Myspace?” Well, no, not many do, but many dormant accounts still exist. People set up the free accounts in the early 2000s and simply forgot about them when shiny objects like Twitter and Facebook burst onto the scene and supplanted the one-time head honcho of social networks.
A good rule of thumb is to get rid of any accounts that you are not actively using. The reason for this is that if you aren’t actively managing an account — and regularly changing the password on it — you could be leaving yourself at risk, especially if you are in the habit of reusing passwords.
3. By the way: Don’t reuse passwords. I’ve mentioned it a few times already, but it deserves its own point. Just say no to reusing passwords. Sure, it makes things easy for you, but consider the password you used to join a My Little Pony community being stolen and allowing crooks into your bank account.
4. Activate two-factor authentication. Most online services enhance user security by offering two-factor authentication. They use app verification or SMS to ensure that the person attempting to get into an account is the person authorized to use the account. (Note: Dropbox offers this option.)
What is two-factor authentication and where should you enable it? http://t.co/WSvDc9oSvb #passwords #privacy #security
— Kaspersky (@kaspersky) June 9, 2014
5. Be wary of third-party integration. Many online services, such as Facebook and Dropbox, let you connect with third-party services for extra functions such as sharing files or competing in games with friends. The integration often makes life easier (and can mean not needing to remember yet another password). The flip side of that ease of use is accepting more potential points of failure when it comes to security. Sure App X may save you some time when you’re sharing updates on the go, but does it safely secure the keys to your digital castle?
Before connecting services, think twice. Is it vital to use one login — or to create another account? The answer is up to each user, but the question is one to seriously consider.
In closing, the Dropbox data breach is another eye-opener and an important example of how criminals continue to target digital identities. We strongly advise everyone to roll the tips above into a regular security hygiene check. We have home security systems and locks for our terrestrial lives; we should be just as vigilant about our digital lives.
Tips