Further Down the Trello Rabbit Hole

guest · Jun 6, 2018

Further Down the Trello Rabbit Hole
June 6, 2018
https://krebsonsecurity.com/2018/06/further-down-the-trello-rabbit-hole/

Last month’s story about organizations exposing passwords and other sensitive data via collaborative online spaces at Trello.com only scratched the surface of the problem.

By default, Trello boards for both enterprise and personal use are set to either private (requires a password to view the content) or team-visible only (approved members of the collaboration team can view).
But individual users may be able to manually share personal boards that include personal or proprietary employer data, information that gets cataloged by Internet search engines and available to anyone with a Web browser.

[...] a few weeks ago the Trello page for Seceon featured multiple usernames and passwords, including credentials to log in to the company’s WordPress blog and iPagedomain hosting.

Other entities that inadvertently shared passwords for private resources via public Trello boards included a Chinese aviation authority; the International AIDS Society; and the global technology consulting and research firm Analysis Mason, which also exposed its Twitter account credentials on Trello until very recently.
Click to expand...

mirimir · Jun 7, 2018

There are many gotchas with cloud services. Public vs private can be such a subtle and ephemeral distinction.

guest · Jan 30, 2020

Trello exposed! Search turns up huge trove of private data
January 30, 2020
https://nakedsecurity.sophos.com/20...d-search-turns-up-huge-trove-of-private-data/

Hands up who’s used the increasingly popular online collaboration platform Trello?
Trello is great for organising to-do lists and for coordinating team tasks.

When news broke last week about office space company Regus exposing the performance ratings of hundreds of its staff via a public Trello board, Craig thought he’d take another look at what’s out there.
An enthusiastic Trello user himself, Craig quickly found a trove of highly sensitive data sprayed out by sizeable numbers of public Trello boards.

Craig also discovered a staff board for what appears to be some sort of facilities company that listed names, emails, dates of birth, ID numbers, bank account information, and more:
Click to expand...

Why do people set sensitive boards to public?
One would assume, in most cases, this is not deliberate. The design of Trello has changed over the years so it might be related in part to a past issue. It’s also possible that some are made public by one individual for a legitimate reason, the security implications of which are lost on other users of the same board.

Some boards are set up, made public, and eventually forgotten (although not by Google). It’s the latest version of the whole shadow IT problem where people use tools they don’t fully understand how to use securely.
Click to expand...

Log in or Sign up

Further Down the Trello Rabbit Hole

guest Guest

mirimir Registered Member

guest Guest

Log in or Sign up

Further Down the Trello Rabbit Hole

guest Guest

mirimir Registered Member

guest Guest

Useful Searches