Zouheir Abdallah revealed that a hacker already knows the victim’s credentials for Dropbox account that has 2FA authentication enabled, is able to hack it.
Few hours ago I was informed that Q-CERT team found a critical vulnerability in DropBox that allows a hacker to bypass the two-factor authentication implemented by the popular file sharing service.
Just a few days ago I have spoken of the necessity for SMBs to implement a two-factor authentication to improve security for resources and services exposed on the Internet. Principal service providers such as LinkedIn, Google and Facebook has already implemented a two-factor authentication process to protect the user’s account for violations and abuse.
The researcher Zouheir Abdallah revealed that an attacker already knows the victim’s credentials (username and password obtained with a Key-logger, cross-site shared password, due the adoption of a easy to guess password etc..), for Dropbox account that has two-factor authentication enabled, is able to hack that account following the described procedure.
The flaw is related to the lack of verification of authenticity of the email addresses used to sign up a new DropBox account, a hacker could conduct the attack creating a new fake account similar to the target one and append a dot (.) anywhere in the email address.
For example to attack the DropBox account zuz.85@hotmail.com the hacker could register a fake account zuz……85@hotmail.com
In the second step of hacking process the attacker has to enable two-factor authentication for the fake account he created to obtain the emergency code generated at the end of the process. The code allows DropBox users to disable two factor authentication from his account in case of loss or theft.
Next, the attacker logout from the fake account and logging into the Dropbox victim’s account, which has 2FA enabled, with the victim’s real credentials.
The Dropbox victim’s account will request submission of the OTP code, but at this point the hacker will simulate the lost of device choosing the option “I Lost My Phone” from the authentication screen.
Submitting the “Emergency Code” the attacker could disable the two-factor authentication, but the flaws allow the him to use the emergency code generated using the fake account to disable two-Factor authentication for the victim’s account.
Pierluigi Paganini
