Breach Disclosure: Dubsmash

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being Dubsmash, a video message application. The disclosed information contained 162 million rows of email address, username and PBKDF2 password hashes. The Dubsmash breach, along with others in the Register report, has been made available to the general public while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Dubsmash is number 4 out of the 16 breaches from The Register report that have been disclosed to the public this month. This disclosed breach contained 162 million rows of email address, username and PBKDF2 password hashes. Dubsmash announced this incident 3 days before The Register report. The company itself reported the following information as being compromised:

• Usernames
• Encrypted passwords
• Email addresses
• Birthdates
• Phone numbers
• Country/language information

The 3 additional fields on the user notice were not disclosed publicly. Dubsmash also noted that not all breached records contained this information.