Attacker Used Qubole's Trusted AWS Access to Raid Customer Cloud Accounts

Between October 14 and October 26, an attacker broke into AWS accounts belonging to multiple customers of Qubole, a data lake platform owned by Idera, according to cloud security company Wiz. The attacker used credentials for the AWS account that Qubole's platform uses to reach its customers. How those credentials were obtained has not been disclosed.

Qubole works inside customers' AWS accounts through an IAM role, which is an AWS identity with its own permissions. The role trusts Qubole's AWS account, and each request to use it must include a matching External ID. Wiz found that most of the roles the attacker used were otherwise unused, but they still trusted Qubole's account, so the requests worked. AWS guidance says the External ID is not treated as a secret.

In the accounts examined, the attacker searched for stored credentials. It read Lambda environment variables, pulled secrets from Secrets Manager and read values from the SSM Parameter Store. It then tested what it found with TruffleHog. The credentials included victims' own AWS access keys, Entra ID client secrets and Okta client credentials.

Any organisation that has connected Qubole to AWS, even one that no longer uses it, should check its CloudTrail logs from October 1 onward. The sign to look for is an AssumeRole request from account 805246085872 that came from an address outside AWS. It is not yet clear whether the credentials have been disabled or the activity has stopped, and neither Qubole nor Idera had posted a statement when The Hacker News checked.