6 ms·

Trello did not lead anything here. A credential stuffing attack found 15M email addresses that attackers already knew had Trello accounts.

grtuhxdxb 3y ago
Umm… wrong? > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred
- jimmygrapes 3y ago
  Which "publicly accessible resource using email addresses from previous breach corpuses" are they referring to? Am I being paranoid that HIBP itself is a potential vector for this enumeration type data exfiltration?
  - hiddencost 3y ago
    Yeah, paranoid. The data in hibp are all public elsewhere on the dark web
- deleted 3y ago
  [deleted]
- danpalmer 3y ago
  > using email addresses from previous breach corpuses > enumerating a publicly accessible resource > Trello advised that no unauthorised access had occurred That sounds like a credential stuffing attack to me! Most likely the attackers used the password reset form, and that Trello acknowledge the existence of emails. This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Alternatively it's possible they used some sort of sharing functionality to try to share Trello content with other addresses, and again the availability of that for usage would be by-design.
  - haswell 3y ago
    I'm struggling to reconcile this: > This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Against this: > 15M email addresses While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration. I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.
    - danpalmer 3y ago
      FWIW, I'm trusting the public statement from Trello here. They could be wrong, but given that the data doesn't appear to contain anything new (like Trello passwords), it seems plausible. I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
      - transcriptase 3y ago
        Perhaps they could notice 15m requests with a CTR of 0.0000000% Which is surely far below the CTR one would expect for people actually using the share feature on Trello.
hipadev23 3y ago
Yes they did. Trello leaked usernames, full names, “other account details” in exchange for an email address input. Credential stuffing requires knowledge of the password.
- danpalmer 3y ago
  Credential stuffing can use the password, but in general it's just using some credentials you already have (maybe just an email) against a different service to see what you get out.
  - hipadev23 3y ago
    Can you just admit you’re wrong here? If I go to a service with 1 piece of information (an email) and I walk away with more PII than I provided, that’s a leak.
- MattGaiser 3y ago
  Trello reveals these via their "share" functionality. Put in an email and you get a name and username. This isn't a leak. It is designed that way.
  - deleted 3y ago
    [deleted]
  - xwolfi 3y ago
    So let me try to "share" something with on a banking app, see if that returns your balance. And then I'll tell you it's designed that way after I publish it along with 15M other people's balance. Not a leak guys !
  - deleted 3y ago
    [deleted]
PedroBatista 3y ago
It's not Trello, it's Atlassian who did not learn and doesn't seem to care that much. Even in 2017 it seemed to me Atlassian only bought it so anyone else couldn't have it and they would like it to die in the future but for the time being they could use it as future customer acquisition entry for their main products ( Jira and Confluence ) Their disinterest in Trello in recent years might just be what has saved it for so long. Once their crack teams of product development people arrives it will be game-over.

grtuhxdxb 3y ago

Umm… wrong? > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred

jimmygrapes 3y ago
Which "publicly accessible resource using email addresses from previous breach corpuses" are they referring to? Am I being paranoid that HIBP itself is a potential vector for this enumeration type data exfiltration?
- hiddencost 3y ago
  Yeah, paranoid. The data in hibp are all public elsewhere on the dark web
deleted 3y ago
[deleted]
danpalmer 3y ago
> using email addresses from previous breach corpuses > enumerating a publicly accessible resource > Trello advised that no unauthorised access had occurred That sounds like a credential stuffing attack to me! Most likely the attackers used the password reset form, and that Trello acknowledge the existence of emails. This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Alternatively it's possible they used some sort of sharing functionality to try to share Trello content with other addresses, and again the availability of that for usage would be by-design.
- haswell 3y ago
  I'm struggling to reconcile this: > This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Against this: > 15M email addresses While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration. I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.
  - danpalmer 3y ago
    FWIW, I'm trusting the public statement from Trello here. They could be wrong, but given that the data doesn't appear to contain anything new (like Trello passwords), it seems plausible. I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
    - transcriptase 3y ago
      Perhaps they could notice 15m requests with a CTR of 0.0000000% Which is surely far below the CTR one would expect for people actually using the share feature on Trello.

hipadev23 3y ago

Yes they did. Trello leaked usernames, full names, “other account details” in exchange for an email address input. Credential stuffing requires knowledge of the password.

danpalmer 3y ago
Credential stuffing can use the password, but in general it's just using some credentials you already have (maybe just an email) against a different service to see what you get out.
- hipadev23 3y ago
  Can you just admit you’re wrong here? If I go to a service with 1 piece of information (an email) and I walk away with more PII than I provided, that’s a leak.
MattGaiser 3y ago
Trello reveals these via their "share" functionality. Put in an email and you get a name and username. This isn't a leak. It is designed that way.
- deleted 3y ago
  [deleted]
- xwolfi 3y ago
  So let me try to "share" something with on a banking app, see if that returns your balance. And then I'll tell you it's designed that way after I publish it along with 15M other people's balance. Not a leak guys !
- deleted 3y ago
  [deleted]

PedroBatista 3y ago

It's not Trello, it's Atlassian who did not learn and doesn't seem to care that much. Even in 2017 it seemed to me Atlassian only bought it so anyone else couldn't have it and they would like it to die in the future but for the time being they could use it as future customer acquisition entry for their main products ( Jira and Confluence ) Their disinterest in Trello in recent years might just be what has saved it for so long. Once their crack teams of product development people arrives it will be game-over.