Comment by floatingatoll | Hacker News Reader

Comment by floatingatoll | Hacker News Reader

If the user's computer is compromised, a simple SQLite query run against the Dropbox configuration database would reveal all Dropbox email addresses in use by that user.

If the user's email is compromised, the Dropbox confirmation email would be easy to locate and harvest, either from their mailbox, or their mail hosting provider's delivery logs.

(Usually, however, malware simply scans for all incoming email addresses, and then reports them to a central authority for later spamming.)

EDIT: As pointed out elsewhere in this thread, the email address <dropbox@yourdomain> is trivially guessable by dictionary spam attacks.

There are many routes to this information leaking. It is not at all apparent whether it's Dropbox yet.

Given that Dropbox security is actively responding in the linked forum, it seems as though this HN post - submitted by one of the users posting in that thread as "affected" - is solely to create "buzz", rather than to share news with Hacker News.

All signs point to Dropbox (or a 3rd party app linked to Dropbox) as the source of the leak:

* Multiple users with email addresses unique to their Dropbox account are reporting spam. It's unlikely these individuals' computers or email accounts were all compromised at the same time.

* These same users aren't reporting spam on their other unique addresses or catchall accounts. Some of them are non-trivial addresses that would be hard to guess. It's unlikely to be a bot guessing email addresses.

As pointed out by users in the forum post, the compromised e-mail addresses have been used not on just one Dropbox account but several. Additionally those e-mail addresses were not just trivial guesses like dropbox1@domain.com or dropbox2@domain.com, or at least they were for me.

Maybe I'm missing something here, but where else could a non-guessable e-mail address which was never used anywhere else been leaked from if not Dropbox itself?

Offhand, it could be leaked from your hard drive or any backup thereof, from email stored on any of your desktop or mobile devices, or from your email provider's mail stores or mail logs. There's probably other ways too.

EDIT: Apps. Any app you've ever authorized to use your Dropbox account could have leaked the email address - for instance, via plaintext logs, or malicious behavior, or well-intended but stupid behavior - by writing the email address in plaintext to disk, or uploading it to a remote server and then losing control of it there.

Through a compromised system. As noted above, and in many other places, there are many attacks that focus on harvesting email addresses. Until the exploit is verified, you cannot say for a fact that the disclosure is Dropbox's fault, you can only say that it is a probable source.

Reply on news.ycombinator.com