Zouheir Abdallah revealed that a hacker already knows the victim’s credentials for Dropbox account that has 2FA authentication enabled, is able to hack it.
Few hours ago I was informed that Q-CERT team found a critical vulnerability in DropBox that allows a hacker to bypass the two-factor authentication implemented by the popular file sharing service.
Just a few days ago I have spoken of the necessity for SMBs to implement a two-factor authentication to improve security for resources and services exposed on the Internet. Principal service providers such as LinkedIn, Google and Facebook has already implemented a two-factor authentication process to protect the user’s account for violations and abuse.
The researcher Zouheir Abdallah revealed that an attacker already knows the victim’s credentials (username and password obtained with a Key-logger, cross-site shared password, due the adoption of a easy to guess password etc..), for Dropbox account that has two-factor authentication enabled, is able to hack that account following the described procedure.
The flaw is related to the lack of verification of authenticity of the email addresses used to sign up a new DropBox account, a hacker could conduct the attack creating a new fake account similar to the target one and append a dot (.) anywhere in the email address.
For example to attack the DropBox account zuz.85@hotmail.com the hacker could register a fake account zuz……85@hotmail.com
In the second step of hacking process the attacker has to enable two-factor authentication for the fake account he created to obtain the emergency code generated at the end of the process. The code allows DropBox users to disable two factor authentication from his account in case of loss or theft.
Next, the attacker logout from the fake account and logging into the Dropbox victim’s account, which has 2FA enabled, with the victim’s real credentials.
The Dropbox victim’s account will request submission of the OTP code, but at this point the hacker will simulate the lost of device choosing the option “I Lost My Phone” from the authentication screen.
Submitting the “Emergency Code” the attacker could disable the two-factor authentication, but the flaws allow the him to use the emergency code generated using the fake account to disable two-Factor authentication for the victim’s account.
Pierluigi Paganini
Pierluigi Paganini Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.
