In a concerning turn of events for the cybersecurity community, Dashlane, a widely-used password manager, has disclosed a targeted attack on its user base. Attackers managed to download encrypted password vaults by exploiting a flaw in how new devices are registered to user accounts. Fortunately, only fewer than 20 users were impacted before Dashlane’s security protocols mitigated the attack. This breach sheds light on both potential vulnerabilities and the importance of strong security practices.
The attack hinged on abusing Dashlane’s device enrollment mechanism. Typically, when adding a new device, Dashlane sends a one-time six-digit code to the user’s registered email. This code must be entered on the new device to complete the registration process.
However, attackers employed a brute-force tactic at a substantial scale. They targeted the API endpoints responsible for device registration with a massive volume of requests across various accounts, akin to a technique called password spraying. This strategic flooding increased their chances of bypassing some conventional rate-limiting systems, albeit marginally.
Fortunately, Dashlane’s security measures—specifically automatic lockouts—provided substantial protection. The attackers were only successful in accessing fewer than 20 accounts, downloading the encrypted vaults. These vaults remained protected by strong encryption, leveraging Argon2 algorithms that fortify password security.
Argon2 is a robust hashing algorithm that enhances defense against decryption attempts by making the password-to-hash conversion both resource-intensive and time-consuming. This deters even skilled hacking attempts unless the master password is particularly weak or commonly used.
Dashlane has reached out to impacted users, advising them to update their master passwords and vault contents as a precautionary measure. They have assured users who have not received a notification that they remain unaffected.
Key Takeaways:
-
Scale and Approach: Attackers increased their probability of compromising accounts by massively targeting multiple users simultaneously through API vulnerabilities.
-
Outcomes: Successful breaches were confined to under 20 users, thanks to Dashlane’s proactive automatic account lockout mechanisms.
-
Security Fortifications: Dashlane’s implementation of Argon2 encryption provides robust protection against password cracking, highlighting the critical importance of strong, unique master passwords.
-
Response and Recommendations: Affected users have been contacted, and a call for password updates has been broadly recommended to maintain continued security.
This incident highlights the reality that even systems with considerable defenses can be vulnerable to sophisticated attacks. It underscores the imperative for continuous vigilance and robust security practices among users and service providers alike. The onus remains on everyone to bolster cybersecurity measures and remain informed about potential threats.