The threat actor targeted the API endpoints for device registration and used a brute force attack to send a large volume of automated requests to those endpoints.
In response, Dashlane’s automated security systems operated as intended, triggering an automatic lockout of the targeted accounts to protect those users. Before the attack was fully mitigated, the threat actor was able to brute force and generate valid tokens for fewer than 20 personal plan customers, allowing them to register a new device on those accounts and download copies of users’ encrypted vaults.
And yeah, I was able to reproduce that in a quick test run, provide email + TOTP (in my case) & you get a couple of objects that are Argon2d + AES-CBC-HMAC protected (though I didn’t bother to dive deeper yet, if anyone cares: The header would be $1$argon2d$16$3$32768$2$aes256$cbchmac$16$ ).
If Dashlane indeed then failed to put strong Rate Limits in place to allow successful 6-digit OTP guessing for 20 accounts I am honestly… baffled, especially as this now enables an offline attack against the master password.
Another interesting quirk I noticed during my test, and it’s only partially related: If you are trying to set up TOTP it requires you to first provide a phone number for Recovery purposes. And yeah, they will just SMS you a MFA recovery code. Obviously doesn’t bypass the master password but I guess Dashlanes security model is kinda fine with a dedicated attacker grabbing your vault?
The Dashlane advisory has been updated to say this:
The goal of the attack was to brute-force two-factor authentication (2FA) protections to allow the attacker to register new devices on existing user accounts.