Dropbox 数据泄露
8 分•作者: hmate9•27 天前
我今天收到了来自 Dropbox 的安全通知，称我的账户在 2026 年 8 月 4 日至 8 月 21 日期间被未经授权地访问，并且 Dropbox 认为账户中的文件被查看或下载了。
根据邮件内容，Dropbox 使用联想（Lenovo）作为身份提供商，允许用户使用经过验证的联想 ID 登录 Dropbox。
Dropbox 表示：
“联想的电子邮件验证流程出现问题，导致未经授权的第三方使用您的电子邮件地址注册了联想 ID，然后使用该联想 ID 登录了与该电子邮件地址关联的 Dropbox 账户。”
所以，据我理解，攻击路径大致如下：
1. 攻击者使用受害者的电子邮件地址注册了一个联想 ID。
2. 联想错误地将该电子邮件地址视为已验证。
3. Dropbox 信任该联想身份。
4. 攻击者获得了与该电子邮件地址关联的 Dropbox 账户的访问权限。
Dropbox 表示，他们已经撤销了所有通过联想 ID 验证的会话，并从我的账户中移除了联想链接。他们还表示，在没有先输入 Dropbox 密码的情况下，将无法再使用联想身份验证登录该账户。
我搜索了 Dropbox 或联想的公开披露信息，但尚未找到。
是否有人收到过同样的通知，或者看到过关于此漏洞的公开信息？
我特别想知道联想 ID 登录机制的可用范围有多广，以及可能有多少 Dropbox 账户受到了影响。
查看原文
I received a security notice from Dropbox today saying that my account was accessed without authorization between August 4 and August 21, 2026, and that Dropbox believes files in the account were viewed or downloaded.<p>According to the email, Dropbox uses Lenovo as an identity provider, allowing users to authenticate to Dropbox with a verified Lenovo ID.<p>Dropbox says:<p>an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.<p>So, as I understand it, the attack path was roughly:<p>1. Attacker registers a Lenovo ID using the victim’s email address.
2. Lenovo incorrectly treats the email address as verified.
3. Dropbox trusts the Lenovo identity.
4. Attacker gets access to the Dropbox account associated with that email address.<p>Dropbox says it has since expired all sessions authenticated through Lenovo ID and removed the Lenovo link from my account. It also says Lenovo authentication can no longer be used for the account without first entering the Dropbox password.<p>I’ve searched for a public disclosure from Dropbox or Lenovo and haven’t found one yet.<p>Has anyone else received the same notice, or seen any public information about this vulnerability?<p>I’m particularly interested in knowing how broadly the Lenovo ID login mechanism was available and how many Dropbox accounts may have been affected.