603
15M Trello accounts have been leaked (lemy.lol)
submitted 2 years ago* (last edited 2 years ago) by to c/technology@lemmy.world
101 comments fedilink hide all child comments
 

I just got the email from haveibeenpwned. F Trello.

you are viewing a single comment's thread
view the rest of the comments
[–] 165 points 2 years ago (36 children)

Obligatory: companies should face harsh penalties for this stuff.

  • permalink
  • fedilink
  • source
  • hideshow 36 child comments
    •
  • [–] 50 points 2 years ago (2 children)

    They do, in the EU. If you fuck up your customer's data, you'll face fines consisting of hefty percentages of your yearly revenue!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 19 points 2 years ago (1 child)

    https://www.enforcementtracker.com/

    Yep, hefty. Top 5: 1.2B meta, 746M amazon, 405M meta, 390M meta, 345M tiktok (all in €).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 2 years ago*

    Oh noooo, 1% of their yearly gross revenue or 1.3% of their yearly gross profit. What a fine!

    Side note: I would love to discover a public record of them paying these fines... we hear they ate fined, but never that they had to pay them. What is stopping them from cutting a deal of a payment plan over 20 years with 0% interest or full up front but only paying 30% of it or some lobbying BS.

    We can infer that for sure this fine is coming out pre-tax.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 38 points 2 years ago* (8 children)

    This is not something a company did.

    The group of people took a list of user names and passwords from a different breach and tried them on trello to see if people used the same password and wrote down which ones did.

    Nothing a company can possibly do to stop this, only users can.

    Even if the company required 2 factor authentication to fully log in, getting this far would still confirm each account/password combo was correct, which is all the "hackers" did.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 21 points 2 years ago (5 children)

    This isn't completely true, but it is the current standard.

    A website can detect and block many user/password attempts from the same IP and block IPs that are suspicious.

    Websites can detect elivated login fails across many IPs are react accordingly (It may be reasonable to block all logins for a time if they detect an attack like this)

    I'm sure there are other strategies, I don't know how often they are actually employed, but I wish companies would start taking this sort of attack more seriously (even if it's not at all hacking)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 10 points 2 years ago (2 children)

    CGNAT would throw a wrench in that when you have thousands of users using mobile data and they appear to be coming from the same ip.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 years ago* (1 child)

    It may be reasonable to block all logins for a time if they detect an attack like this

    That would be a P1 incident and probably violate SLAs depending on the duration.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 2 years ago

    Inserting a literally meaningless delay like 5 seconds is sufficient to make your service virtually impenetrable to mass bruteforce/stuffing attacks. Credential stuffing become untenable when your trying to stuff 1million creds with a 5 second cooldown. Most normal users who would hit it would just think their wifi or cell service hicupped.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 26 points 2 years ago (12 children)

    Yes but this wasn't a data breach. This was a data stuffing incident, meaning they took someone else's data dump and tried their email and credentials here.

    • never use the same username and password in two or more places
    • always use MFA, a hard token if you can like a yubikey
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    Physical token over TOTP authenticator?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago

    all the root secrets are available in plain text the generator app at some point, they have to be. moving that to a single purpose device greatly reduces the risk of vulnerabilities in your phone leading to exfiltration via internet connection

  • permalink
  • fedilink
  • source
  • parent
  • [+] -8 points 2 years ago (5 children)

    Do you own a Yubikey?

    Have you ever succeeded in getting it to work with anything??

    It didn't work with gmail, or any other online account I had.

    An absolute waste of $$.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 8 points 2 years ago

    mine works for my personal google account, work one is sso and doesn't have it enabled. otherwise gh, aws, auh0 support it, I'm forgetting some others I use. beyond that you can generate 2fa codes too

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 2 years ago

    I use yubikey everywhere it's available for me. Initially, the first few websites in the early years were challenging. I think a lot of devs were still trying to figure out the workflow.

    But today, it's usually as simple, or simpler, than TOTP.

    So it might be worth trying again. I'd use a YubiKey 4 or higher if you can. If you have an older one, you may want to upgrade to take advantage of the newer technology like NFC and Bluetooth if you're into that.

    I just wish YubiKey could store more than like 30 TOTP tokens.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 years ago

    Sounds like a skill issue.

    Have had yubikey for a few years. It was a pain to set it up initially, but it took me less than an hour if I remember correctly. Since then the only issue I have is that sometimes I accidentally bump into it and it pastes an OTK to a random place.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 14 points 2 years ago* (3 children)

    tbf it's just email, username and real name so it's basically nothing when half of users are name.lastname@gmail.com either way.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 2 years ago (2 children)

    For project tools like Trello, a good portion of your userbase is company emails. A malicious actor now has a list of company emails that they can compare against public facing data like Linkedin, imitate a user using a gmail based off their name, sending an email to that company's IT team asking for an MFA reset sent to the newly created gmail account. Now imagine if that compromised user is a developer with admin access to production environments. These were the conditions for various ransomware attacks.

    An email, username, real name are not much, but it's a foot in the door.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago* (1 child)

    It is a foot in the door but honestly there are way too many doors out there so it's really hard to measure the real damage of this.

    I worked at a pretty major employment company like 20 years ago when basically everything was legal and we didn't need to buy dark web datasets to find real names and contacts ever - most of that data is publicly available and can be captured with simple public scrapers and email checks.

    I think expectation of names and emails being private should be thrown out of the window entirely and every security system should implicitly assume these details are publicly known.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago

    So the conditions I mentioned were directly from a series of ransomware attacks from the group BlackCat including the high profile ransomware incident targeting MGM Casinos last year. My team recently used the same premise during an incident response drill based on that event.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 12 points 2 years ago (6 children)

    I agree that data security is important, even if it is only email addresses, where many are probably findable in the web anyway. Maybe, the link with the username has some value, but I’d bet only little. In my opinion, harsh penalties are more needed in privacy invasive (in my opinion malware) like google, meta, Amazon etc. are spreading.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 9 points 2 years ago (5 children)

    The problem is that this data can be combined with other data. An email address by itself isn't particularly important but when it's matched up with names, physical addresses, DoB, SSN, other PII and the network of other services with matching data it becomes very serious.

    It's never just this breach, it's every other breach as well. Every breach makes every preceeding breach more effective and more valuable.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    Except this contains none of that

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •