In a significant cybersecurity incident, compromised IAM credentials linked to big-data platform Qubole’s AWS account were exploited by a threat actor to extract data from numerous organizations. This breach, identified by cybersecurity experts, highlights vulnerabilities within cross-account IAM roles often used by SaaS platforms operating in customer AWS environments.
How the Breach Occurred
The attack involved the unauthorized use of IAM credentials to assume roles that organizations had established for Qubole’s AWS account. These roles are typically created during the onboarding process, allowing Qubole to access customer environments when necessary, often through an External ID.
The compromised credentials enabled the attacker to access and extract data from AWS environments belonging to over a dozen entities. According to cybersecurity firm Sentra, the roles exploited were remnants left active long after organizations had ceased using Qubole’s services, inadvertently leaving open access to critical data.
Details of the Attack
This malicious campaign commenced on October 14 and persisted until October 26. During this period, the attackers used these roles to enumerate resources, gather secrets and configurations, and access sensitive information. The attacks were traced back to a rented server from OVH and utilized the Mullvad VPN, with no activity originating directly from Qubole’s network.
Wiz, collaborating with Sentra, noted that the attackers employed a systematic naming convention for role sessions, using prefixes like ‘quiam-‘ followed by suffixes that indicated their actions, such as ‘quiam-enum’ and ‘quiam-scope-full.’ This structured approach facilitated the exploitation of AWS storage locations, where the threat actor tested and harvested credentials using tools like TruffleHog.
Implications and Response
The opportunistic nature of this attack saw the actor indiscriminately accessing data available in AWS S3 buckets, sometimes downloading entire buckets in a single session. Although an ISO file intended for remote booting to extract data was identified, there is no evidence to suggest it was deployed.
Wiz has not linked this campaign to any known state-sponsored activities. The motivations behind the data theft remain unclear, as do the potential uses of the stolen information. Additionally, a separate campaign was discovered, active between October 8 and October 11, targeting Qubole integrations by testing customer-owned AWS access keys.
This incident underscores the importance of regularly reviewing and revoking unnecessary access permissions, particularly in the context of cloud security and third-party integrations. Organizations are urged to assess their IAM role configurations and ensure that dormant or unneeded roles are effectively managed to prevent similar breaches.
