Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Using OpenDNS Updater v. 2.2.1 and everything has been going fine however, within the past couple of days, it is now showing "authorization token is invalid".
I suddenly had the same here. Followed the advise that 389613569152 gave but I could not find anything on the OpenDNS page where they list characters. So just did an update of my password (with all kind of characters in it) and now the error is gone.
I got an email basically saying that OPENDNS was hacked and that my authorization token was invalid, and I needed to update it. Anyone else get this email? Is it a scam? Thanks. April 22nd, 2020.
I also got the email on Apr 22nd. It looks legit to me. Here is the content of the email:
Umbrella/OpenDNS Dynamic IP Updater Data Incident Notification
You are receiving this notice as, according to our records, you are a user of the Cisco Umbrella/OpenDNS “Dynamic IP Updater” software. If an administrator contact was available, they are in the CC line of this email.Please see the bottom of this message for account information we have on file.
On 13 April 2020, Cisco became aware that an Umbrella/OpenDNS diagnostics site was publicly accessible. We immediately disabled public access to the site and determined that some log events within the Dynamic IP Updater system were partially visible between March 26, 2020 and April 13, 2020. As a precaution, we have taken steps to help protect the security of your account and your action is required to restore full functionality. Cisco is committed to transparency and this communication provides further detail about this incident along with further instructions.
Incident Analysis Upon notification, access to the Umbrella/OpenDNS diagnostics site was immediately disabled and Cisco confirmed it is no longer publicly accessible. After a comprehensive log review, we determined that a limited number of unauthorized users may have viewed log events that included the Dynamic IP Updater API Token. This token data could be exploited to review and/or modify Umbrella/OpenDNS configurations and view event history. While Cisco has seen no anomalous API token use within our system logs, we have also taken the precautionary measure of revoking the API token to protect the security of your account. You must follow the API Token Re-Generation instructions below to restore full functionality. For reference: The API Token is automatically generated when a new account is created. The API Token does not generally require any action to be taken by a user to manage. In this instance, the Token must be regenerated since the Umbrella/OpenDNS staff revoked your API Token to protect your account’s security.
Action Required: API Token Re-Generation Revoking the API token prevents the Dynamic IP Updater client from updating the registered IP address. To restore full functionality, you will need to take the following steps for each instance of the Dynamic IP Updater: 1) Open the OpenDNS Dynamic IP Updater client 2) Click “Change Account” 3) Sign in again Detailed steps are outlined on this page: https://support.opendns.com/hc/en-us/articles/227987807-How-to-configure-the-OpenDNS-Dynamic-IP-Updater-Client
Should you encounter any issues or are having difficulty reconnecting your client, please contact Umbrella Support at umbrella-support@cisco.com. Please note that if you do not regenerate the API token(s) as described, Cisco Umbrella/OpenDNS will no longer provide expected functionality as the security and content policies will be automatically set to an unconfigured state.
Action Timeline Here is a summary of our actions taken:
Date
Action taken
26 March 2020
Umbrella/OpenDNS diagnostic site became publicly available due to network configuration change
13 April 2020
Cisco notified about unintended public access to diagnostics site
13 April 2020
Cisco disabled access to site and began identification of impacted users
14 April 2020
Further mitigation taken to eliminate possibility of token misuse
22 April 2020
API tokens revoked; customers notified
Cisco takes any data security incident very seriously and we are committed to quickly remediating such issues. Internally, we are working with the involved teams to assess why this occurred and what steps we can take to avoid a similar incident in the future. We are very sorry for any inconvenience or concern this incident may have caused.
Please contact Cisco by replying to this email or contacting your account team if you have questions or would like to discuss further.
Sincerely, Cisco Data Protection team We have the installer and related details noted as email: <my details redacted>
This looks indeed authentic. It apparently concerns a limited number of users, having the official OpenDNS Updater. That explains why many did not get this e-mail. The ones who did should follow the advises.
