3 ms·

> using email addresses from previous breach corpuses > enumerating a publicly accessible resource > Trello advised that no unauthorised access had occurred

> using email addresses from previous breach corpuses > enumerating a publicly accessible resource > Trello advised that no unauthorised access had occurred That sounds like a credential stuffing attack to me! Most likely the attackers used the password reset form, and that Trello acknowledge the existence of emails. This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Alternatively it's possible they used some sort of sharing functionality to try to share Trello content with other addresses, and again the availability of that for usage would be by-design.

haswell 3y ago
I'm struggling to reconcile this: > This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Against this: > 15M email addresses While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration. I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.
- danpalmer 3y ago
  FWIW, I'm trusting the public statement from Trello here. They could be wrong, but given that the data doesn't appear to contain anything new (like Trello passwords), it seems plausible. I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
  - transcriptase 3y ago
    Perhaps they could notice 15m requests with a CTR of 0.0000000% Which is surely far below the CTR one would expect for people actually using the share feature on Trello.

haswell 3y ago

I'm struggling to reconcile this: > This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice. Against this: > 15M email addresses While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration. I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.

danpalmer 3y ago
FWIW, I'm trusting the public statement from Trello here. They could be wrong, but given that the data doesn't appear to contain anything new (like Trello passwords), it seems plausible. I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
- transcriptase 3y ago
  Perhaps they could notice 15m requests with a CTR of 0.0000000% Which is surely far below the CTR one would expect for people actually using the share feature on Trello.