Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker got those credentials has not been disclosed. Qubole, a data lake platform owned by Idera,
Qubole, a data lake platform owned by Idera, experienced a security breach in October when hackers exploited its trusted access to AWS accounts of multiple customers. The attacker obtained credentials for an AWS account utilized by Qubole's platform to access customers' accounts. The method through which the attacker acquired these credentials remains undisclosed.
Qubole allows customers to create IAM roles, which grant specific permissions to an AWS identity. The trust policy of these roles enables Qubole's AWS account to assume the role and gain corresponding permissions. Despite most of the roles targeted by the attacker being unused, they still trusted Qubole's account, allowing the attacker's requests to succeed.
Organizations that have connected Qubole to AWS, even those no longer using the platform, should review their CloudTrail logs from October 1 onward, specifically looking for AssumeRole requests originating from the Qubole account (805246085872) with an external IP address. These activities have not been linked to any other publicly reported incidents, and the targeting does not align with the usual objectives of state-backed groups.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
