DropBox account hacking bypassing two-factor authentication

Jul 8, 2013, 11:30 am EST

Zouheir Abdallah revealed that a hacker already knows the victim’s credentials for Dropbox account that has 2FA authentication enabled, is able to hack it.

Few hours ago I was informed that Q-CERT team found a critical vulnerability in DropBox that allows a hacker to bypass the two-factor authentication implemented by the popular file sharing service.

Just a few days ago I have spoken of the necessity for SMBs to implement a two-factor authentication to improve security for resources and services exposed on the Internet. Principal service providers such as LinkedIn, Google and Facebook has already implemented a two-factor authentication process to protect the user’s account for violations and abuse.

The researcher Zouheir Abdallah revealed that an attacker already knows the victim’s credentials (username and password obtained with a Key-logger, cross-site shared password, due the adoption of a easy to guess password etc..), for Dropbox account that has two-factor authentication enabled, is able to hack that account following the described procedure.

The flaw is related to the lack of verification of authenticity of the email addresses used to sign up a new DropBox account, a hacker could conduct the attack creating a new fake account similar to the target one and append a dot (.) anywhere in the email address.

For example to attack the DropBox account zuz.85@hotmail.com the hacker could register a fake account  zuz……85@hotmail.com

In the second step of hacking process the attacker has to enable two-factor authentication for the fake account he created to obtain the emergency code generated at the end of the process. The code allows DropBox users to disable two factor authentications from his account in case of loss or theft.


Next, the attacker logout from the fake account and logging into the Dropbox victim’s account, which has 2FA enabled, with the victim’s real credentials.

The Dropbox victim’s account will request submission of the OTP code, but at this point the hacker will simulate that he lost  his device choosing the option “I Lost My Phone” from the authentication screen.


Submitting the “Emergency Code” the attacker could disable the two-factor authentication, but the flaws allow the him to use the emergency code generated using the fake account to disable two-Factor authentication for the victim’s account.

(Source: CDM, Pierluigi Paganini, Editor and Chief)

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase