What happened
On 14 October 2022 GitHub told Dropbox that something was wrong. Suspicious activity had begun the day before. Dropbox found that an attacker had used its employees' GitHub credentials to copy 130 of its code repositories. It disclosed the breach on 1 November 2022.
The email
The messages impersonated CircleCI, a service that many software teams use to build and test code. Dropbox called them legitimate-looking. Some got past its filters into employees' inboxes. The link led to a fake CircleCI login page. There, employees entered their GitHub username and password. They also used their hardware authentication key to pass a one-time password to the fake site, which handed it straight on to the real one.
A few weeks earlier, on 21 September 2022, GitHub had warned about a wider campaign with the same pretext. That warning listed lookalike domains such as circle-ci.com and circle-cl.com, and described how the fake pages relayed one-time codes in real time. BleepingComputer linked the Dropbox breach to that campaign.
Why it worked
CircleCI is part of a developer's daily routine, and many teams sign in to it with their GitHub account. An email about it looks like ordinary work. A login page that asks for GitHub credentials looks right for the same reason.
The one-time code did not protect the account, because the fake site passed it on within seconds. GitHub's warning said that accounts protected by hardware security keys were not vulnerable to this relay. Dropbox's account says its employees used a hardware key to pass a one-time password. Neither source explains the difference, so this archive leaves the question open.
What it cost
The repositories held modified copies of third-party libraries, internal prototypes, and tools and configuration used by the security team. They also held some credentials, mainly API keys used by developers, and a few thousand names and email addresses of employees, customers, sales leads and vendors. Dropbox said no core app or infrastructure code was taken, and no account contents, passwords or payment information.
Dropbox disabled the attacker's GitHub access the same day, rotated the exposed credentials, and notified regulators and law enforcement.
What would have helped
Dropbox drew the main lesson itself. It accelerated its move to WebAuthn, the standard behind hardware security keys and device biometrics, which check the website's real address before they answer. A fake page on a lookalike domain gets nothing from them.
What a warning inside the message would have shown. Antilure checks every link in a message against the brand it imitates, flags a link that leads to an unrelated sign-in page, and shows the real destination in its Details panel. A link to a domain such as circle-ci.com is the pattern its lookalike check looks for.
Sources
- How we handled a recent phishing incident that targeted Dropbox, Dropbox Security Team, 1 November 2022.
- Dropbox discloses breach after hacker stole 130 GitHub repositories, Sergiu Gatlan, BleepingComputer, 1 November 2022.
- Security alert: new phishing campaign targets GitHub users, Alexis Wales, GitHub Blog, 21 September 2022.