The Psychological Underpinnings of Modern Hacking Techniques
The tactics employed by hackers today aren’t new; they’re simply adapted for the digital age, exploiting the same human weaknesses that have always existed.
darkreading – Read More
Dropbox Breach Exposes Customer Credentials, Authentication Data
Threat actor dropped in to Dropbox Sign production environment and accessed emails, passwords, and other PII, along with APIs, OAuth, and MFA info.
darkreading – Read More
What are passkeys? Experience the life-changing magic of going passwordless
Here’s how to take the first steps toward ditching passwords for good.
Latest stories for ZDNET in Security – Read More
Ransomware Defense Startup Mimic Raises Hefty $27M Seed Round
A new Silicon Valley startup called Mimic is coming out of the shadows with a hefty $27 million seed-stage funding round led by Ballistic Ventures.
The post Ransomware Defense Startup Mimic Raises Hefty $27M Seed Round appeared first on SecurityWeek.
SecurityWeek – Read More
Two years in, Google says passkeys now protect more than 400 million accounts
Google Account users have authenticated themselves using passkeys more than 1 billion times, but passwords are likely to be around for years.
Latest stories for ZDNET in Security – Read More
Popular Android Apps Like Xiaomi, WPS Office Vulnerable to File Overwrite Flaw
Several popular Android applications available in Google Play Store are susceptible to a path traversal-affiliated vulnerability that could be exploited by a malicious app to overwrite arbitrary files in the vulnerable app’s home directory.
“The implications of this vulnerability pattern include arbitrary code execution and token theft, depending on an application’s 
The Hacker News – Read More
Building the Right Vendor Ecosystem – a Guide to Making the Most of RSA Conference
As you look to navigate RSA Conference, with so many vendors, approaches and solutions, how do you know what solutions you should be investing in?
The post Building the Right Vendor Ecosystem – a Guide to Making the Most of RSA Conference appeared first on SecurityWeek.
SecurityWeek – Read More
Name That Edge Toon: Puppet Master
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.
darkreading – Read More
The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics
Outabox, an Australian firm that scanned faces for bars and clubs, suffered a breach that shows the problems with giving companies your biometric data.
Security Latest – Read More
Dropbox Sign e-signature service hacked | Kaspersky official blog
Dropbox shared the results of an investigation into a hack in its infrastructure. Company does not specify when the incident actually occurred, stating only that the attack was noticed by the company employees on April 24. We explain what happened, what data was leaked and how to protect yourself and your company from the consequences of the incident.
Dropbox Sign hack: how it happened and what data was stolen
Unidentified attackers managed to compromise the Dropbox Sign service account and thus gain access to the platform’s internal automatic configuration mechanism. Using this access, hackers were able to lay hands on a database that contained information about Dropbox Sign users.
As a result, the following data of registered users of the Sign service was stolen:
usernames;
email addresses;
phone numbers;
passwords (hashed);
authentication keys for the DropBox Sign API;
OAuth authentication tokens;
SMS and application two-factor authentication tokens.
If users of the service interacted with it without creating an account, then only their names and email addresses were leaked.
Dropbox claims that it found no signs of unauthorized access to the contents of user accounts, that is, documents and agreements, as well as payment information.
As a protective measure, Dropbox reset the passwords for all Dropbox Sign accounts and ended all active sessions, so you will have to log in to the service again and set a new password.
Does the Dropbox Sign hack affect all Dropbox users?
Dropbox Sign, formerly known as HelloSign, is Dropbox’s standalone cloud document workflow tool, primarily for signing electronic documents. The closest analogues of this service are DocuSign and Adobe Sign.
As the company emphasizes in its statement, Dropbox Sign’s infrastructure is “largely separate from other Dropbox services.” Judging by the results of the company’s investigation, the Dropbox Sign hack was an isolated incident and did not affect other Dropbox products. Thus, according to the information we have now, it does not in any way threaten users of the company’s main service, the Dropbox cloud file storage itself. This is also true for those users whose Sign account was linked to their main Dropbox account.
What should you do about Dropbox Sign being hacked?
Dropbox has already reset passwords for all Dropbox Sign accounts. So you will have to change the password in any case. We recommend using a completely new password rather than a slightly modified version of the old one. Ideally, you should generate a long random combination of characters using password manager and store it there.
Since two-factor authentication tokens were also stolen, you should reset them as well. If you used SMS, the reset occurred automatically. And if you used an application, you will have to do it yourself. To do so, go through the process of registering your authenticator app with the Dropbox Sign service again.
The list of data stolen by hackers also includes authentication keys for the Dropbox Sign API. So if your company used this tool through the API, then you need to generate a new key.
Finally, if you’ve used the same password in any other services, you should change it as quickly as possible. Especially if it was accompanied by the same username, email address, or phone number that you specified while registering for Dropbox Sign. Again, for this it is convenient to use the password manager, which, by the way, is part of our security solution for small businesses.
Kaspersky official blog – Read More