dropbox security glitch
DESCRIPTION
Dropbox security glitch. Lewis Scaife SYSM 6309 Advanced Requirements Engineering Summer 2013 Professor – Dr. Lawrence Chung. Case STUDY. The Problem/Incident. Internal company action compromised system security. - PowerPoint PPT PresentationTRANSCRIPT
Dropbox security glitchCASE STUDY
Lewis ScaifeSYSM 6309 Advanced Requirements Engineering
Summer 2013Professor – Dr. Lawrence Chung
The Problem/Incident• Internal company action compromised system security.• Software patch/update introduced software bug compromising authentication mechanism.•On June 19, 2011 from 1:54pm PT until 5:46pm PT, all users accounts could be accessed using any password.
Impact•Dropbox had 25 million users at the time of the incident.• Loss in confidence that data is secure within Dropbox infrastructure.• Loss of confidence in cloud community as a whole.
Company ResponseHi Dropboxers, Yesterday we made a code update at 1:54pm Pacific time that introduced a bug affecting our authentication mechanism. We discovered this at 5:41pm and a fix was live at 5:46pm. A very small number of users (much less than 1 percent) logged in during that period, some of whom could have logged into an account without the correct password. As a precaution, we ended all logged in sessions.We’re conducting a thorough investigation of related activity to understand whether any accounts were improperly accessed. If we identify any specific instances of unusual activity, we’ll immediately notify the account owner. If you’re concerned about any activity that has occurred in your account, you can contact us at [email protected] should never have happened. We are scrutinizing our controls and we will be implementing additional safeguards to prevent this from happening again.-Arash
Process•Were software requirements specified?
•Were quality controls in place during software development?
•Did Dropbox test software patch before deploying it within their production environment.?
Regression Testing•Functionality of existing code should not change when new code is inserted within the program.
•Attempts to find bugs introduced by small changes/updates in a program.
•Test case selection and prioritization.
Goals for Case Study•Develop measures to decrease the probability of a software bug causing authentication vulnerabilities.
•Research testing and validation tools which can be used to verify functionality of code prior to release.
• Present findings.
Questions
?
