Attackers backdoor trusted AWS integrations to steal secrets
Unknown attackers used compromised identity and access management (IAM) credentials associated with Qubole's AWS account to access customer AWS environments, stealing secrets and other sensitive data from S3 buckets.
Key points
- Once inside customers’ environments, the crooks began probing a ton of AWS services and stealing credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
- While investigating this incident, Wiz spotted a separate campaign between October 8 and October 11 that also used customer-owned AWS access keys for Qubole integrations.
- Qubole is a cloud data processing platform that uses cross-account IAM roles to manage compute and access storage in customers' AWS environments without requiring customers to provide long-lived AWS access keys.
The miscreants also used TruffleHog to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials also uncovered while snooping around the AWS environments.
Additional details
- “Because many organizations left trust policies active even after deprecating the platform, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and siphon data,” the researchers told The Register in an emailed response to questions.
- The calls originated from Qubole AWS account 805246085872, and used IAM user ID AIDA3W7DIFLYOLTK63SFS, Wiz analysts Zack Morrow, Sean Johnstone, and Benjamin Read said in a Monday blog about the supply chain attack.
- Customers should also review CloudTrail from October 1 onward, looking for AssumeRole events where userIdentity.accountId matches Qubole's AWS account ID, 805246085872, particularly those originating from non-AWS IP addresses.
- Wiz, working with Google's Mandiant incident responders after AI data security company Sentra flagged suspicious activity, traced the malicious activity back to October 14, when credentials associated with Qubole's AWS account were used to call the sts:AssumeRole API to obtain temporary credentials for customer-managed integration roles.
- While a “small number” of these also resulted in the intruders compromising victim organizations’ AWS environments, Wiz said it can’t definitively connect the two sets of malicious activity.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.