On 1 November 2022 Dropbox disclosed that an attacker had reached around 130 internal GitHub repositories. The route was a phishing campaign beginning in early October in which employees received messages impersonating CircleCI and were directed to a convincing fake login page.
Employees entered their GitHub username and password, and then a one-time password generated using their hardware authentication key. The attacker relayed both to the real service. Dropbox stated the repositories were not those of its core applications, containing modified third-party libraries, internal prototypes and tooling, but confirmed that some plaintext secrets including API keys were present in the code, along with a few thousand names and email addresses.
This Corrects The Lesson From August
We filed at 22-0808 that Cloudflare withstood a campaign that took Twilio, because Cloudflare used FIDO2 physical keys. The available reading of that file is "hardware key good", and this incident shows why that reading is wrong.
The protection at Cloudflare was not the metal. It was origin binding: a FIDO2 assertion is computed against the domain requesting it, so a lookalike site receives something the genuine site rejects. A hardware key operated in one-time-password mode emits a short string that the user reads and types, and any string a user can type into the wrong box can be relayed to the right one. Same device, different mode, opposite outcome.
The Pretext Was A Build System
The phish impersonated CircleCI, a continuous integration service developers interact with constantly and largely without thinking. That is a well-chosen pretext: it targets a routine, not a person.
We have recorded CircleCI itself compromised two months later at 23-0104, with customers told to rotate every secret it held. Developer tooling occupies a position of extraordinary trust and receives correspondingly little scrutiny, which the desk also files at 26-0717 and 26-0711.
Secrets Were In The Code Again
Dropbox’s statement is careful about what the repositories were not, and then notes that plaintext API keys were in them.
That is the same finding as 22-1222, where a privileged access manager’s own credential sat in a script, and 23-0104. Secret material accumulates in source control because putting it there is the path of least resistance at the moment of writing, and it is discovered by whoever reads the repository next.
Compiled from Dropbox’s disclosure and contemporaneous analyses of it, listed below. The explanation of why origin-bound authentication resists relay while a typed one-time code does not is this desk’s reasoning from the design of the standards, presented as such rather than as a claim about Dropbox’s configuration. No actor is named. Graded high. Corrections: corrections@forensicpost.com.