Cyber company Wiz, together with Israeli data security company Sentra and Google's Mandiant, exposed an attack in which an attacker abused the permissions of data processing platform Qubole to break into its customers' Amazon (AWS) cloud environments. According to Wiz, between October 14 and 26 the attacker used access credentials (IAM) from an AWS account linked to Qubole, assumed the roles customers had set up for Qubole and stole secrets and data from many customers' accounts. According to BleepingComputer, dozens of companies were affected.
The mechanism is simple and worrying. So Qubole can process data for a customer, the customer sets up a 'role' in its AWS account that lets Qubole's account enter and act. It is a legitimate and very common mechanism. But once someone obtained Qubole's credentials, all those roles became open doors. According to Wiz, the attacker appeared opportunistic, taking whatever it found in S3 storage.
It is still unknown how the attacker obtained Qubole's credentials, and according to reports the company has not issued a public statement about the incident. Qubole, a veteran big-data processing platform, has long been out of the spotlight, and that is exactly why the case is troubling: some customers have probably forgotten they even have an active role granting it access, still in place years after they stopped using the service.
It is a pattern repeating itself this week again and again. A French bank was robbed through a technology vendor, a Japanese email vendor exposed addresses of hundreds of customers, and now a data vendor served as a back door into the cloud. In every case, the attacker did not attack the organization directly but whoever the organization gave a key to. That an Israeli company, Sentra, was a partner in the discovery also shows how central cloud data security has become to Israel's cyber industry.
What to do? Wiz recommends mapping every role in AWS accounts that allows access from external accounts and deleting any unused Qubole role. Where the vendor supports it, restrict the trust policy to the specific identity the vendor uses rather than its whole account. And in general: every vendor you stop working with should lose its access the same day.
