How attackers bypassed Dropbox by faking Lenovo IDs

How attackers bypassed Dropbox by faking Lenovo IDs

Dropbox uses Lenovo Identity Provider Services as part of its login system, allowing users to sign in with a verified Lenovo ID instead of their Dropbox password. Between August 4 and 21, attackers exploited a flaw in Lenovo's email verification process to break into approximately 5,000 Dropbox accounts. Here is how it worked.

The attack steps

• An attacker registered a fraudulent Lenovo ID using someone else's email address. Lenovo's email verification process had a flaw that allowed this without confirming the attacker actually controlled that email.
• The attacker then went to Dropbox and chose to log in using the fraudulent Lenovo ID.
• Dropbox trusted Lenovo's assertion that the attacker controlled the email address. It did not require the user to confirm their identity through the existing Dropbox login method, such as entering their Dropbox password.
• The attacker gained full access to the Dropbox account registered under that email address, without knowing the Dropbox password.
• According to Reuters, the attacker viewed and downloaded content from some accounts.

What users noticed

Some affected users reported seeing a 'Continue with SSO' option appear on the Dropbox login page for their email address, even though they had never created a Lenovo ID. This was an early sign that something was wrong. Users also received notifications about suspicious sign-in attempts around two weeks before Dropbox's formal warning.

What changed

Dropbox and Lenovo resolved the issue by expiring all sessions authenticated through Lenovo IDs. Dropbox added a new requirement: users attempting to sign in with a Lenovo ID must now also enter their Dropbox account password. This ensures that even if an attacker has a fraudulent Lenovo ID, they still cannot access the account without the Dropbox password.

Lenovo confirmed that the issue was specific to a legacy integration between Lenovo ID and Dropbox, and that Lenovo customers themselves were not affected.