Un bug in Dropbox consente l’accesso agli account senza password corretta

DropboxDropbox, una delle più note aziende fonitrici di cloud computing, ha pubblicato un comunicato in cui  ha avvisato i propri utenti che, come conseguenza dell’aggiornamento del proprio sistema, per alcune ore è stato possibile accedere ai loro servizi,  senza immettere la password corretta.

L’azienda ha assicurato che il problema è stato risolto e che sono stati colpiti meno dell’1% degli utenti.

Dropbox sta ora  individuando gli utenti interessati dal problema, in modo da inviar loro notifica dell’accaduto.

Questo il testo del comunicato:

“Hi Dropboxers,

Yesterday we made a code update at 1:54pm Pacific time that introduced a bug affecting our authentication mechanism. We discovered this at 5:41pm and a fix was live at 5:46pm. A very small number of users (much less than 1 percent) logged in during that period, some of whom could have logged into an account without the correct password. As a precaution, we ended all logged in sessions.

We’re conducting a thorough investigation of related activity to understand whether any accounts were improperly accessed. If we identify any specific instances of unusual activity, we’ll immediately notify the account owner. If you’re concerned about any activity that has occurred in your account, you can contact us at support@dropbox.com.

This should never have happened. We are scrutinizing our controls and we will be implementing additional safeguards to prevent this from happening again.

-Arash

[Update – 10:46pm] – We’re working around the clock to gather additional data and continue to review logs for potentially unauthorized activity. We aim to notify users who had login activity during the period within the next few hours.

We are sorry for this and regardless of how many people were ultimately affected, any exposure at all is unacceptable to us. We will continue to provide regular updates.”

>> Il comunicato sul blog di Dropbox

Share

Lascia un commento