<![CDATA[Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users."]]>RE: https://infosec.exchange/@briankrebs/116670688015956223

Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." Dashlane said there was no evidence of a hack of its own systems, but it hasn't shared yet why or how that 2FA was compromised. The company said “the goal of the attack was to brute-force two-factor authentication (2FA) protections to allow the attacker to register new devices on existing user accounts,” and that it has already notified affected users.

Just a moment...

favicon

(support.dashlane.com)

]]>https://board.circlewithadot.net/topic/7f6ca5c4-5f38-4f49-95fd-b3d1d1221731/dashlane-posted-an-update-saying-hackers-brute-forced-its-two-factor-authentication-system-and-gained-access-to-the-encrypted-password-vaults-for-fewer-than-20-personal-plan-users.RSS for NodeFri, 05 Jun 2026 19:03:13 GMTWed, 03 Jun 2026 11:25:44 GMT60<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 12:01:01 GMT]]>@dalias You got it. Put that dusty old bitcoin mining botnet to work on it!

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/briankrebs/statuses/116686065626667050https://board.circlewithadot.net/post/https://infosec.exchange/users/briankrebs/statuses/116686065626667050Wed, 03 Jun 2026 12:01:01 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:54:05 GMT]]>@briankrebs Ahhh, that makes sense. So if they have strong passphrases, nothing. But if weak, crackable offline with big resources.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116686038364072886https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116686038364072886Wed, 03 Jun 2026 11:54:05 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:51:02 GMT]]>@dalias They got access to 20 encrypted vaults. They'd still have to work out the master password for those targeted accounts. Theoretically, that could be done offline, as happened w/ the breach at LastPass, but it took many months for a lot of those stolen vaults to be cracked.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/briankrebs/statuses/116686026368876910https://board.circlewithadot.net/post/https://infosec.exchange/users/briankrebs/statuses/116686026368876910Wed, 03 Jun 2026 11:51:02 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:49:30 GMT]]>@briankrebs "gained access to the encrypted password vaults" sounds like they weren't encrypted.

Unless they mean the attackers only gained access to what amounts to random bits.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116686020309881307https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116686020309881307Wed, 03 Jun 2026 11:49:30 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:48:48 GMT]]>@shironeko @briankrebs
If they knew the master password then the whole vault is compromised as they got an encrypted offline copy of that too

Terrifying.

I eagerly await updates on this as more facts are discovered…

]]>https://board.circlewithadot.net/post/https://tenforward.social/users/gareth/statuses/116686017561868834https://board.circlewithadot.net/post/https://tenforward.social/users/gareth/statuses/116686017561868834Wed, 03 Jun 2026 11:48:48 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:43:24 GMT]]>@briankrebs brute-forcing 2FA? Like they brute-forced the 2FA codes? There was no rate limiting? No failure after N tries? That's not really better

]]>https://board.circlewithadot.net/post/https://cosocial.ca/users/pl/statuses/116685996350657481https://board.circlewithadot.net/post/https://cosocial.ca/users/pl/statuses/116685996350657481Wed, 03 Jun 2026 11:43:24 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:37:41 GMT]]>@briankrebs the fact that Dashlane allowed 2FA to be brute forced instead of raising timeouts and warning users is what worries me.

  • Tho granted, what else did I expect from a proprietary SaaS-only "solution" that literally infringed on John Deere's logo in the past (which I presume was the reason they changed their logo some time ago!)…
]]>https://board.circlewithadot.net/post/https://tech.lgbt/ap/users/116655881384112498/statuses/116685973839994355https://board.circlewithadot.net/post/https://tech.lgbt/ap/users/116655881384112498/statuses/116685973839994355Wed, 03 Jun 2026 11:37:41 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:37:35 GMT]]>@briankrebs @koehntopp I could imagine one scenario where if they allow adding a second device base on only 2fa (stupid) then you can try a lot of users and someone will be hit just by chance and the rate limit would not apply.]]>https://board.circlewithadot.net/post/https://fedi.tesaguri.club/objects/0318e845-d628-41a3-8e43-05b147ec1b1fhttps://board.circlewithadot.net/post/https://fedi.tesaguri.club/objects/0318e845-d628-41a3-8e43-05b147ec1b1fWed, 03 Jun 2026 11:37:35 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:36:51 GMT]]>@briankrebs
Well, there's a recent surge of sites where the default after entering your email is you're being sent a code to that email - THAT is something that would not require knowing the password, but it's also not 2FA (well, not as we'd use that word, anyway)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/koehntopp/statuses/116685970557048242https://board.circlewithadot.net/post/https://infosec.exchange/users/koehntopp/statuses/116685970557048242Wed, 03 Jun 2026 11:36:51 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:36:05 GMT]]>@briankrebs Is their 2FA not normal 2FA then? I'd expect a 6 digit code that changed every 30 seconds or so.. brute forcing that would be incredibly unlikely.

]]>https://board.circlewithadot.net/post/https://toot.hoyle.me.uk/users/tony/statuses/116685967524526062https://board.circlewithadot.net/post/https://toot.hoyle.me.uk/users/tony/statuses/116685967524526062Wed, 03 Jun 2026 11:36:05 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:35:14 GMT]]>@koehntopp I had the same question. Seems to me, the only way brute-force is useful as an attack is if you can by default try a large number of possible combinations at once, but they're saying that rate limiting was what caused the affected accounts to get locked out the other day. Something isn't adding up.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/briankrebs/statuses/116685964196947827https://board.circlewithadot.net/post/https://infosec.exchange/users/briankrebs/statuses/116685964196947827Wed, 03 Jun 2026 11:35:14 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:33:50 GMT]]>@briankrebs hmm I'm not familiar with how dashlane works, but how did they reach 2fa? I guess their
master password was weak?]]>https://board.circlewithadot.net/post/https://fedi.tesaguri.club/objects/6e772b32-45c8-445d-a893-97f55eb0c277https://board.circlewithadot.net/post/https://fedi.tesaguri.club/objects/6e772b32-45c8-445d-a893-97f55eb0c277Wed, 03 Jun 2026 11:33:50 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:32:53 GMT]]>@briankrebs
Brute force 2FA...?

That does not sound like something that should be successfully possible? Wouldn't you have to know the password before that, too?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/koehntopp/statuses/116685954999461107https://board.circlewithadot.net/post/https://infosec.exchange/users/koehntopp/statuses/116685954999461107Wed, 03 Jun 2026 11:32:53 GMT<![CDATA[Reply to Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." on Wed, 03 Jun 2026 11:28:16 GMT]]>@briankrebs Brute forcing 2FA seems a bit strange. Never used Dashlane though so I have no idea what methods they might be using. REST endpoint that allows an unlimited amount of 6 digit tries?

I'm _so_ curious as to how they've managed this.

]]>https://board.circlewithadot.net/post/https://swecyb.com/users/troed/statuses/116685936832121001https://board.circlewithadot.net/post/https://swecyb.com/users/troed/statuses/116685936832121001Wed, 03 Jun 2026 11:28:16 GMT