I just got the email from haveibeenpwned. F Trello.

  • Albatross2724@lemmy.world
    link
    fedilink
    English
    arrow-up
    5
    ·
    9 months ago

    For project tools like Trello, a good portion of your userbase is company emails. A malicious actor now has a list of company emails that they can compare against public facing data like Linkedin, imitate a user using a gmail based off their name, sending an email to that company’s IT team asking for an MFA reset sent to the newly created gmail account. Now imagine if that compromised user is a developer with admin access to production environments. These were the conditions for various ransomware attacks.

    An email, username, real name are not much, but it’s a foot in the door.

    • Dr. Moose@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      9 months ago

      It is a foot in the door but honestly there are way too many doors out there so it’s really hard to measure the real damage of this.

      I worked at a pretty major employment company like 20 years ago when basically everything was legal and we didn’t need to buy dark web datasets to find real names and contacts ever - most of that data is publicly available and can be captured with simple public scrapers and email checks.

      I think expectation of names and emails being private should be thrown out of the window entirely and every security system should implicitly assume these details are publicly known.

      • Albatross2724@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        9 months ago

        So the conditions I mentioned were directly from a series of ransomware attacks from the group BlackCat including the high profile ransomware incident targeting MGM Casinos last year. My team recently used the same premise during an incident response drill based on that event.