After complaints of spam targeting the inboxes of Dropbox users began to surface earlier this week, the company sought the help of outside security experts to assist in investigating a possible data breach.
Joe Gross, an engineer at the free file-hosting service, addressed the issue after users flooded the company's forum with complaints.
“We continue to investigate and our security team is working hard on this,” Gross wrote Wednesday in a forum post. “We've also brought in a team of outside experts to make sure we leave no stone unturned.”
According to forum posts, the unsolicited messages are coming from dodgy online casinos, with many of the messages coming from a spammer called “Euro Dice Exchange.” Some users said that the email accounts being attacked were solely created for the purpose of using Dropbox, indicating that the spam may be related to a possible email address leak.
The fact that users created email accounts designated for Dropbox is actually a smart strategy, Ron Gula, CEO and CTO of Tenable Network Security, said in an email to SCMagazine.com.
“Common passwords and even common user accounts, which are based on an email, [are] a very weak link exploited by attacks when they compromise any given cloud service,” Gula said.
Victims of the attack are primarily located in Germany, the Netherlands and the U.K. There are currently no reports indicating that subscribers in the United States have been targeted.
As enterprises continue to face challenges concerning policies intended to manage employee use of cloud services, this issue should serve as a wake-up call, said Eric Chiu, president and founder of HyTrust, a virtualization and security company.
“Companies across the board have to take control of applications like Dropbox that are coming into the enterprise and aren't being controlled,” Chiu said. “They can't turn a blind eye to these systems anymore.”
Although the popular file-hosting service experienced a 30-minute web outage on Tuesday, according to Gross it was “incidental and not caused by any external factor or third party.”
