13 ms·
Trello Allegedly Breached
- mcbutterbunz 3y agoWhy did I hear about this from haveibeenpwned rather than from Trello? I received an email from pwned but nothing from Trello.
- cj 3y agoProbably legal reasons. Usually doesn’t make business sense to declare and publicly announce a breach until you do some internal investigating to understand the scope/impact (not defending them, it’s just reality.. also their cyber insurance company would get pissed if they did anything without their approval during a possible breach, things take time) Probably also some internal debate whether this should be considered a breach or not and whether it’s worth the cost of announcing it vs. the risk of not announcing it
- jacquesm 3y agoThere are legal (GDPR, Art. 34) requirements to publish a breach if it hits EU citizens and the bar for publication is met.
- remus 3y agoThis is true, but as the parent mentioned you also need to understand the nature of the breach first. Giving people accurate information is as important as giving them timely information.
- k1t 3y agoFTA: "Trello advised that no unauthorised access had occurred." So they may not feel they need to say anything.
- MattGaiser 3y agoFrom what I can tell, you can get all the info mentioned just by putting an email into the invite popup. So this isn't a leak in that sense. Everything works as intended.
- muteh 3y agoI think it's important to be clear that this isn't some small startup. Trello is Atlassian
- _nalply 3y agoI just found out that I have different passwords for Trello and for Atlassian. Whatever.
- turingfeel 3y agoBecause it wasn’t a breach, the title is misleading. It was just credential stuffing.
- hasty_pudding 3y agoare emails private info?
- enasterosophes 3y agoIt may depend on definitions. Where I work, we classify users' emails as "personal" information, and we would consider it a breach if all the emails were leaked.
- hasty_pudding 3y agoI can see it being a low tier breach.
- Levitating 3y agoWell as the page states, these were scraped from a public endpoint. So not really
- mgbmtl 3y agoWhat's the endpoint? Why did it provide personal information? Why wasn't it throttled? Many things don't matter at a small scale, but they do at 15M-scale. Trello users are about to get bombarded by phishing attempts and spam.
- hasty_pudding 3y agoCheckmate hackers. I already am bombarded by phishing attempts and spam.
- Levitating 3y ago> Trello users are about to get bombarded by phishing attempts and spam. All of the emails present in this "leak" were taken from other dumps. That's how it's made, they took a list of known emails and tried to link them to a trello account.[1] > What's the endpoint? I think https://developer.atlassian.com/cloud/trello/rest/api-group-members/#api-members-id-field-get https://developer.atlassian.com/cloud/trello/rest/api-group-.... The endpoint allows you to get all public info (bio and username) from a trello account by its email.[2] > Why did it provide personal information? So users can invite other users to their boards via their email address. > Why wasn't it throttled? It should've been. [1]: https://haveibeenpwned.com/PwnedWebsites#Trello https://haveibeenpwned.com/PwnedWebsites#Trello [2]: https://www.bleepingcomputer.com/news/security/trello-api-abused-to-link-email-addresses-to-15-million-accounts/ https://www.bleepingcomputer.com/news/security/trello-api-ab...
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- danpalmer 3y agoTrello did not lead anything here. A credential stuffing attack found 15M email addresses that attackers already knew had Trello accounts.
- grtuhxdxb 3y agoUmm… wrong? > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred
- jimmygrapes 3y agoWhich "publicly accessible resource using email addresses from previous breach corpuses" are they referring to? Am I being paranoid that HIBP itself is a potential vector for this enumeration type data exfiltration?
- hiddencost 3y agoYeah, paranoid. The data in hibp are all public elsewhere on the dark web
- deleted 3y ago[deleted]
- danpalmer 3y ago> using email addresses from previous breach corpuses > enumerating a publicly accessible resource > Trello advised that no unauthorised access had occurred That sounds like a credential stuffing attack to me! Most likely the attackers used the password reset form, and that Trello acknowledge the existence of emails. This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Alternatively it's possible they used some sort of sharing functionality to try to share Trello content with other addresses, and again the availability of that for usage would be by-design.
- DanAtC 3y agoWhere do the lists added to HIBP come from? I can't imagine HIBP is paying these characters on BreachForums or wherever they're sold.
- SparkyMcUnicorn 3y agoTroy gets sent some of the data, and some of the breaches come along with good story. Even the FBI has provided some data for HIBP. https://www.troyhunt.com/tag/have-i-been-pwned-3f/ https://www.troyhunt.com/tag/have-i-been-pwned-3f/
- grtuhxdxb 3y agoBad title. Attackers queried Trello with email addresses and got back names, usernames and if the addresses were valid. You can use a lot of services to do that, but usually they cost money. > > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred
- jbverschoor 3y agoThat’s still leaking.
- amanzi 3y agoYou are both correct. The title is bad since it says "Trello leaked 15M email addresses" but the email addresses were already leaked and were used to look up the additional details. It is still leaking (names and usernames), but Trello didn't leak 15m email addresses.
- btown 3y agoHow can they confirm that the email addresses were all from previous breach corpuses without buying said corpuses? Attackers could have been probing for first name + last name combinations to confirm business email addresses, for instance. Just because the parameter was "email address" doesn't mean that those email addresses weren't automatically generated.
- xwolfi 3y agoYou misunderstand, I have a very unique French email address and I got the email. There is no way they enumerated my email address, there is no way they matched 15M randomly generated first.last@gmail.com emails: mine wasn't even that. For info, that same email address has been receiving many many haveibeenpwned warnings, it's everywhere and I consider it basically completely public lol.
- givemeethekeys 3y agoIf these email addresses get leaked to criminals, then the rest of us should have them too. Come on, Trello - hook an entrepreneur up!
- amanzi 3y agoThe email addresses weren't leaked by Trello - they were already leaked from "previous breach corpuses". So if you want the email addresses, you just need to be hanging out in the same forums and sites as the bad actors.
- xyst 3y agoThis is why I use burner e-mails for many of these services
- linhns 3y agoGuess I'm right to have never used their services.
- ijhuygft776 3y agoYou probably should stop using any service on the internet to be on the safe side...
- 2024throwaway 3y agoI assume all of my information is public, from my SSN, email, name, DOB, to all my possible security questions. This is why I have my credit frozen with every agency, and all of my security question answers are plausible sounding, but entirely fake, answers stored in my password manager. I'm not sure there is anything else we can do as consumers.
- TedDoesntTalk 3y agoMy mother has at least 20 maiden names.
- orblivion 3y agohtiusdhtehdhstansuhetauhtaneouh? Is that Finnish?
- 2024throwaway 3y agoThese answers suffer from a company support representative accepting "a long string of letters" as an answer, which they often do. Much better to use a 'plausible' answer like "Fielder" or "Pitt" or any random real last name.
- Sanzig 3y agoHyphenate it for more entropy - eg: Fielder-Pitt.
- numbsafari 3y agoYou can make it mildly more complex by hyphenating. For example “Moss Coane”. Sounds plausible enough, but clearly a fake.
- deleted 3y ago[deleted]
- nerdponx 3y agoMy first car was a FlipperMaster 367i and I grew up on Poopoopeepee Avenue with my favorite pet The Melting Clock In Dali Paintings.
- declan_roberts 3y agoServices like Apple’s “hide my email” are becoming more and more important. Not only does it prevent apps and websites crossing you across the web, it prevents website hacks from identifying you. Expect websites and apps to strong arm your phone number in the future as a result.
- sebazzz 3y agoWe also need something for phone numbers, since these also get leaked all the time and then you get weird Whatsapp calls. Reporting has no use, the numbers in Whatsapp never get blocked.
- kioleanu 3y agoI use Fastmail for that and without noticing, I'm to 32 "fake" addresses. Got banned by EA for buying and playing a game with an account on such an address.
- holigot 3y agoYou got banned while using a Fastmail address? That's hard.
- _nalply 3y agoHah, that's dystopian. Taking precautions and being punished for it.
- wodenokoto 3y agoOne man’s precautions are another man’s dataminig opportunity loss …
- gruez 3y agoIf your concern is datamining, then you should be far more concerned about the billing info (which can't be faked) than the email.
- interbased 3y agoAfter getting phished on my RuneScape account, I’ve learned to NEVER reuse passwords, and enable 2FA wherever possible so when a data leak like this happens, the risk is mitigated to just that website, if at all. All passwords are randomly generated strings.
- octodog 3y agoHow are attackers getting username and real names from this? Surely the password reset page doesn't reveal that information?
- MattGaiser 3y agoThe "share" button for a board does. Share a Trello board and enter an email. It returns a full name and a username in the response and sometimes the UI.
- jgalt212 3y agoI don't want to diminish security leaks in general, but if your email address is first.last@employer.com where's the breach? Given, this I think Saas services should make a move back towards usernames.
- neonate 3y agohttps://nitter.net/H4ckManac/status/1747527579559411959 https://nitter.net/H4ckManac/status/1747527579559411959 https://haveibeenpwned.com/PwnedWebsites#Trello https://haveibeenpwned.com/PwnedWebsites#Trello
- pentagrama 3y agoThanks for services like Firefox Relay that create masked email addresses. I remember being not able to make my email address not discoverable on my Trello account, at the time I complain to support because random people added me to their kanban boards, now I find other issue with that feature.
- 10729287 3y agoWhat if service is closing or you want to move to another ? Genuine question. I see the short term advantage of all those services offering hidden emails but to me i've got more to lose with it if the service is interrupted for whatever reason than having to filter some spam in a mailbox I got full control on.
- pentagrama 3y agoThose burner emails always forward the messages to your main email.
- marcus_holmes 3y agoAh, The Atlassian Effect kicks in. Turning perfectly good products into steaming bags of horribleness. Sorry, a little snarky. But I predicted Trello would suffer from joining Atlassian, and though this is not how I predicted that would happen (I predicted lots of utterly useless new features clogging up the UI until it's unusable), it is an indicator of The Atlassian Effect in action.
- tushar-r 3y agoThis email leak is probably step one. Someone is going to correlate passwords from other breaches to figure out who reused passwords and then use that to breach accounts. Hopefully Trello is protecting against this with something like an integration with HIBP for logins to force password changes or with MFA.
- mns 3y agoSome months ago my company got certified with the ISO 27001 thing about information security management. It was a horrible process to be part of and in charge for for the IT side and the consultants and auditors where the types of people that take themselves too seriously, haven't worked in a real environment in 20 years and come and suggest things just because it's in the standard, but with no context as to how companies operate. Anyhow, apparently this certification is somehow important for a lot corporate clients, I always said that's it's mostly security theatre. Now I see that both Atlassian and Trello are ISO 27001 certified and they leak the data like this... How do they even get away with this in an audit, maybe because it's just a worthless certification.
- klysm 3y agoI think it’s fundamentally just ass covering. Executives want some kind of certification to be able to say they did due diligence. The quality of the certification doesn’t really matter as long as it’s standard enough
- cypherg 3y agonot a breach or an alleged breach - this was simply testing to mass amounts of email addresses to see if they were valid users.
- ilrwbwrkhv 3y agoNice. About time too. Trello was languishing for far too long. I thought it would have been breached far too early. That's why always create a proxy email and a separate password for each service.