An alarming security breach has affected numerous AWS accounts belonging to Qubole clients, resulting in the theft of sensitive data. According to cloud security firm Wiz, the unauthorized access occurred between October 14 and October 26. The attack leveraged credentials associated with an AWS account used by Qubole’s platform, though the method of credential acquisition remains undisclosed.
Understanding the Breach
Qubole, a data lake service under Idera, manages operations within its clients’ AWS environments by establishing an IAM role. This role, equipped with unique permissions, permits Qubole’s AWS account to execute actions via an AssumeRole request, which includes a specific code called an External ID. Despite the attack, most compromised roles were inactive, yet they maintained trust with Qubole’s account, allowing the breach.
Security Implications and Recommendations
Wiz advises organizations linked to Qubole to inspect their CloudTrail logs from October 1 onwards. Any AssumeRole attempts from Qubole’s account ID, 805246085872, originating from non-AWS IP addresses, should be scrutinized. The extent of the breach remains unclear, with no confirmation from Qubole or Idera regarding the status of the credentials or the cessation of malicious activity.
Technical Analysis of the Attack
The attack utilized AssumeRole requests, each containing a valid External ID, which AWS accepts when issued from a trusted account. AWS’s guidelines note that External IDs are visible to anyone with role access, and Sentra’s detection of anomalies in multiple client environments prompted the disclosure. The attacker sought stored credentials across various services, including Lambda and Secrets Manager, employing tools like TruffleHog to validate access keys and client secrets.
Moreover, the breach involved indiscriminate data exfiltration from accessible S3 buckets. Despite lacking links to state-sponsored activities, Qubole’s vulnerability also extended to AWS access keys employed between October 8 and October 11, compromising several cloud environments.
Steps for Mitigation and Prevention
Security experts recommend rotating credentials, removing obsolete Qubole roles, and refining trust policies to limit access. Implementing source IP conditions could have thwarted the attack’s AssumeRole attempts. Organizations should audit vendor role permissions and establish alerts for unexpected VPN-based AssumeRole requests. Logging practices should be enhanced to monitor sensitive data access, ensuring comprehensive incident response capabilities.
Conclusively, the incident underscores the critical need for robust security measures within cloud infrastructures, urging organizations to proactively safeguard their environments against potential breaches.
