Over a Dozen Organizations Hit in Qubole Supply Chain Attack
A threat actor used the compromised IAM credentials for an AWS account associated with big-data platform Qubole to steal data from over a dozen organizations, cybersecurity researchers discovered.
The credentials allowed the attackers to assume IAM roles organizations had set up for Qubole’s AWS account and access their AWS environments.
Cross-account IAM roles are normal for SaaS platforms that operate within customers’ AWS environments. During onboarding, customers create a role for Qubole, and the vendor’s AWS account can assume the role when needed, typically via an External ID.
The leaked Qubole credentials allowed the threat actor to assume this role and pull data from the AWS environments of over a dozen companies.
“The doors the attacker used were old ones. Qubole roles were still in place long after companies had stopped using Qubole, and those roles could read nearly all of the data the attacker went after,” cybersecurity firm Sentra...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
