Your login page trusts a company you never chose

· · Security

Look at the login page of any service your business uses. Below the password box there is usually a row of buttons: sign in with Google, sign in with Microsoft, sometimes with names you do not recognise. You never chose those. The service did. And each one is a door into your account controlled by a company you have no relationship with.

Dropbox has just demonstrated what happens when one of those doors has a faulty lock.

What happened

During the first three weeks of August, an attacker got into around 5,000 Dropbox accounts. Files were viewed or downloaded from roughly 1,500 of them. No passwords were broken and no Dropbox system was compromised.

Dropbox lets people sign in using a Lenovo ID, an arrangement between the two companies. A flaw in Lenovo's email verification process meant an attacker could register a Lenovo ID against an email address they did not own. Dropbox then honoured that Lenovo ID as proof of identity for the Dropbox account using the same address.

Dropbox described the mechanism plainly in its notice to affected users:

"While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo's email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address."

Read that again, because the important word is "may not". You did not need a Lenovo ID for this to work. You did not need to have heard of Lenovo. Owning a Dropbox account was enough, because the route in was open by default on every account with a matching email address.

Dropbox has since closed it: sessions authenticated through Lenovo IDs were expired, the link between the two was cut, and using a Lenovo ID now also requires the Dropbox password.

The bit that matters for you

Every one of the compromised accounts lacked two-step verification, the second check after a password, usually a code on your phone or a prompt in an app. With that switched on, the faulty Lenovo route would have stopped at the second step.

There is a temptation to file this as user error and move on. Resist it, because the more useful point is structural, and it was well put by Muhammad Yahya Patel of Huntress in ITPro's coverage:

"OAuth grants, SSO connections, and third-party login integrations accumulate silently and rarely get removed when the relationship that created them ends."

That is the shape of this risk. You assess the suppliers you sign contracts with. You do not assess the partnerships those suppliers signed years ago, and you are usually not told about them. A questionnaire sent to Dropbox in June would not have surfaced a legacy identity arrangement with a laptop manufacturer.

Two things follow. First, the security of your account is the security of the weakest sign-in route attached to it, not the strongest. A long unique password is worth nothing if an alternative door opens without it. Second, the second check is what saves you, precisely because it sits after whichever door was used.

What to do this week

  • Turn on two-step verification everywhere that holds business data. This is the single control that would have stopped this incident on every affected account. Start with file storage, email, and anything holding customer records. An authenticator app or a passkey is stronger than a text message, but a text message is far better than nothing.
  • Audit the sign-in methods on your main business accounts. In the security settings of each service, look for "connected accounts", "linked accounts", or "sign-in methods". Remove anything you do not recognise or no longer use. Do this for the shared accounts too, not just your own.
  • Check what third-party apps can reach your data. In Google Workspace or Microsoft 365, review the list of apps that colleagues have granted access to. These grants accumulate quietly, survive the departure of whoever created them, and are rarely reviewed. Revoke what is no longer in use.
  • Add one question to your supplier reviews. "Which third parties can authenticate a user into our account?" It is a fair question, and a supplier who cannot answer it has told you something useful.
  • Treat a forced password reset as incomplete. If a provider tells you accounts were accessed, changing the password does not evict someone already holding a live session. Ask whether sessions have been expired, or find the "sign out of all devices" option and use it.

None of this is expensive. It is mostly ten minutes in a settings page you have never opened, on each of the four or five services that actually matter to your business.

How Steelwise can help

Working out which services hold your business data, who can authenticate into them, and where the second check is missing is a short, practical review. Get in touch if you would like a second pair of eyes on yours.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.