Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

An attacker exploited trusted access to Qubole's AWS account, accessing and stealing data from multiple customer accounts, cloud security company Wiz disclosed. The breach occurred between October 14 and October 26, with the attacker using credentials from an AWS account managed by Qubole. The method of obtaining these credentials remains undisclosed, but the attack highlights vulnerabilities in the trust relationship established between Qubole and its customers' AWS accounts.

Qubole, a data lake platform owned by Idera, operates within its customers' AWS environments through a specific process. Customers create an IAM role, an AWS identity with permissions, to allow Qubole access. The role's trust policy permits Qubole's AWS account to assume this role, provided an External ID from Qubole is included in each request. This setup is intended to control access, but the attacker capitalized on unused roles that still trusted Qubole's account, enabling unauthorized access.

Wiz researchers found that the attacker used the AssumeRole requests, including the correct External ID, to gain access. These requests were accepted by AWS since they originated from the trusted account and included the necessary External ID. Although the External ID is not a secret, it is visible to anyone with access to the role, as per AWS's guidance. The attack was initially detected by Sentra, which alerted Wiz after noticing suspicious activity in several customer environments.

Once inside the accounts, the attacker searched for stored credentials and data. They accessed environment variables for Lambda functions, retrieved secrets from Secrets Manager, and read values from the SSM Parameter Store. The attacker then tested the validity of these credentials using TruffleHog, focusing on AWS access keys, Entra ID client secrets, and Okta client credentials. Additionally, the attacker extracted data from S3 buckets, often downloading entire buckets in single sessions without targeting specific data.

The researchers have not linked this campaign to any known state-backed group, and the targeting does not align with typical state-sponsored objectives. There is also no indication that the credentials have been disabled or that the activity has ceased. Qubole and Idera have yet to release a statement regarding the breach. Organizations using Qubole are advised to scrutinize CloudTrail logs for any AssumeRole requests from Qubole's account, especially those originating from non-AWS addresses.