Dropbox investigates possible email address breach

Enlists third party to investigate spam complaints.

Cloud storage service Dropbox has enlisted third-party security experts to investigate why users were receiving spam to unused email accounts.

Users flocked to Dropbox's forums last week to complain that spam was hitting their dormant Dropbox email accounts.

“We continue to investigate and our security team is working hard on this,” Dropbox engineer Joe Gross posted to the forum on Wednesday.

“We've also brought in a team of outside experts to make sure we leave no stone unturned.

"While we haven’t had any reports of unauthorised activity on Dropbox accounts, we’ve taken a number of precautionary steps and continue to work around the clock to make sure your information is safe."

According to forum posts, the unsolicited messages were coming from dodgy online casinos, with many of the messages coming from a spammer called “Euro Dice Exchange”.

Victims of the attack were primarily located in Germany, the Netherlands and Britain.

Some users said that the email accounts being attacked were solely created for the purpose of using Dropbox, indicating that the spam may be related to a possible email address leak.

Ron Gula, CEO and CTO of Tenable Network Security described how users created email accounts designated for Dropbox as a smart strategy,

“Common passwords and even common user accounts, which are based on an email, [are] a very weak link exploited by attacks when they compromise any given cloud service,” Gula said.

Eric Chiu, president and founder of virtualization and security company HyTrust, said the incident should serve as a wake-up call to enterprises looking to establish policies for managing employee use of cloud services.

“Companies across the board have to take control of applications like Dropbox that are coming into the enterprise and aren't being controlled,” Chiu said.

“They can't turn a blind eye to these systems anymore.”

Dropbox experienced a 30-minute web outage on Tuesday. According to Gross it was “incidental and not caused by any external factor or third party”.

This article originally appeared at scmagazineus.com