Dropbox confirms hackers stole 130 code repositories in GitHub phishing campaign

Shutterstock

Dropbox has confirmed it was the concentrate on of a phishing marketing campaign which observed the organization expose 130 of its possess code repositories on GitHub which have been then copied.

Although the attacker gained entry to the repositories, they didn’t comprise any code for any of its core applications or infrastructure, it reported.

Alternatively, the repositories contained copies of third-party libraries modified for use by Dropbox, some applications, internal prototypes, and configuration information utilised by the security group.

In a public advisory on Tuesday, the company said that it was notified by GitHub on 14 Oct 2022 that there was some suspicious behaviour on its account that took location the prior working day.

Dropbox mentioned that the attacker in no way experienced obtain to the contents of users’ Dropbox accounts, passwords, or payment data, but it observed evidence of access to code made up of some credentials, largely API keys utilised by developers.

The code and knowledge also provided hundreds of names and email addresses belonging to employers, past and current prospects, revenue potential customers, and sellers.

Dropbox identified that an attacker had accessed its account by impersonating computer software administration platform CircleCI which it employs “for select internal deployments” but “the risk to clients is minimum”, it explained. 

In September 2022, GitHub notified users of a phishing marketing campaign active considering that 16 September. The emails mimicked notifications showing up to arrive from CircleCI which inspired people to take current consumer phrases and privacy coverage by signing into GitHub as a result of CircleCI.

The file-hosting services defined that it utilizes GitHub to host general public as very well as non-public repositories. It stated that its employees been given phishing email messages in early October impersonating CircleCI, with the goal of focusing on Dropbox’s GitHub accounts considering that users are ready to enter CircleCI with their GitHub credentials.

Phishing e-mails are typically instantly quarantined, it reported, but this time some slipped past Dropbox’s defences and landed into employees’ inboxes.

The e-mail appeared to seem respectable and took customers to a bogus CircleCI login page in which they have been directed to enter their GitHub credentials. Adhering to this, they then entered their components authentication critical to approve a just one-time password (OTP).

This gave the attackers obtain to just one of Dropbox’s organisation accounts exactly where they copied 130 of its code repositories.

“We acquire our dedication to preserving the privacy of our consumers, associates, and staff severely, and although we consider any risk to them is nominal, we have notified those people affected,” claimed the enterprise.

When Dropbox was informed of the suspicious activity, the attackers’ entry to GitHub was disabled. Security groups ended up able to look into the uncovered developer qualifications and identify what information was accessed or stolen. It also employed external forensic experts to verify its results and reported the attack to regulators and regulation enforcement.

In reaction to the attack, Dropbox is dashing up its adoption of WebAuthn, an API that will allow for straightforward and safe person authentication by using registered gadgets as aspects. It also utilizes general public critical cryptography to guard buyers from superior phishing attacks.

Quickly, Dropbox’s whole atmosphere will be shielded by WebAuthn as a result of biometric components or hardware tokens.

Some pieces of this post are sourced from:
www.itpro.co.uk