3 ms·

Umm… wrong? > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names a

Umm… wrong? > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred

jimmygrapes 3y ago
Which "publicly accessible resource using email addresses from previous breach corpuses" are they referring to? Am I being paranoid that HIBP itself is a potential vector for this enumeration type data exfiltration?
- hiddencost 3y ago
  Yeah, paranoid. The data in hibp are all public elsewhere on the dark web
deleted 3y ago
[deleted]
danpalmer 3y ago
> using email addresses from previous breach corpuses > enumerating a publicly accessible resource > Trello advised that no unauthorised access had occurred That sounds like a credential stuffing attack to me! Most likely the attackers used the password reset form, and that Trello acknowledge the existence of emails. This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Alternatively it's possible they used some sort of sharing functionality to try to share Trello content with other addresses, and again the availability of that for usage would be by-design.
- haswell 3y ago
  I'm struggling to reconcile this: > This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Against this: > 15M email addresses While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration. I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.
  - danpalmer 3y ago
    FWIW, I'm trusting the public statement from Trello here. They could be wrong, but given that the data doesn't appear to contain anything new (like Trello passwords), it seems plausible. I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
    - transcriptase 3y ago
      Perhaps they could notice 15m requests with a CTR of 0.0000000% Which is surely far below the CTR one would expect for people actually using the share feature on Trello.

jimmygrapes 3y ago

Which "publicly accessible resource using email addresses from previous breach corpuses" are they referring to? Am I being paranoid that HIBP itself is a potential vector for this enumeration type data exfiltration?

hiddencost 3y ago
Yeah, paranoid. The data in hibp are all public elsewhere on the dark web

deleted 3y ago

[deleted]

danpalmer 3y ago

> using email addresses from previous breach corpuses > enumerating a publicly accessible resource > Trello advised that no unauthorised access had occurred That sounds like a credential stuffing attack to me! Most likely the attackers used the password reset form, and that Trello acknowledge the existence of emails. This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Alternatively it's possible they used some sort of sharing functionality to try to share Trello content with other addresses, and again the availability of that for usage would be by-design.

haswell 3y ago
I'm struggling to reconcile this: > This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Against this: > 15M email addresses While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration. I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.
- danpalmer 3y ago
  FWIW, I'm trusting the public statement from Trello here. They could be wrong, but given that the data doesn't appear to contain anything new (like Trello passwords), it seems plausible. I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
  - transcriptase 3y ago
    Perhaps they could notice 15m requests with a CTR of 0.0000000% Which is surely far below the CTR one would expect for people actually using the share feature on Trello.