Hackers used a data tool's trusted access to raid customers' cloud accounts

Between October 14 and October 26, an attacker broke into the Amazon Web Services (AWS) accounts of several Qubole customers and stole stored passwords and data, security firm Wiz said. The attacker did not break each company's defenses one by one. It used credentials for the AWS account that Qubole itself uses to reach its customers.

What happened

Qubole is a data lake platform owned by Idera. A data lake is a large store of company data. Qubole works inside its customers' AWS accounts. To allow that, a customer creates a role, which is an AWS identity with its own set of permissions. The role is set to trust Qubole's AWS account.

Each request to use the role must include a code called an External ID. That code is not a secret, though. AWS guidance says anyone with access to the role can see it. So when the attacker's requests came from the trusted account with the right code, AWS let them in. How the attacker got those credentials has not been disclosed.

What the attacker took

Wiz's researchers say the attacker went hunting for stored logins, then tested them with a tool called TruffleHog to see which ones worked. It also copied files out of S3, Amazon's file storage. It took data from any storage bucket a role could reach, sometimes an entire bucket in one session. The loot included:

• Customers' own AWS access keys
• Entra ID client secrets
• Okta client credentials
• Stored company data

Who it affects

Any organization that has connected Qubole to AWS should take this seriously, including ones that no longer use it. Wiz found that most of the roles the attacker used were sitting idle. They still trusted Qubole's account, so they still worked. Companies that never linked Qubole to AWS are not covered by this warning.

A separate set of break-ins ran from October 8 to October 11. In those, an attacker used customers' own AWS access keys, which the researchers believe had been set up for Qubole. A few victims' cloud environments were compromised. This has not been linked to the main attack.

What to do

The steps in the alert box above walk through what to check and fix. One point deserves emphasis. Regular AWS logs show that a role was used, but not which files were read. Several victims lacked the extra logs, so responders could not tell which files the attacker saw.

What is not known yet

Wiz did not say whether the stolen credentials have been shut off or whether the activity has stopped. Neither Qubole nor Idera had posted a statement on their websites when The Hacker News checked. Wiz has not tied the attack to any other known group, and says the targets do not look like those of state-backed hackers. Sentra spotted the activity in several of its customers' environments and alerted the researchers.