WORLDTECHAttackers Abuse Qubole's AWS Trust to Steal Customer Data
Cloud security company Wiz says an intruder broke into AWS accounts of several Qubole customers between October 14 and October 26 and took stored secrets and data. The intrusion exploited the trust Qubole's platform holds inside those customers' cloud environments.
How the intruder got past the trust boundary
Qubole, a data lake platform owned by Idera, runs within its customers' AWS accounts. Customers admit it by creating an IAM role, an AWS identity carrying its own permissions, whose trust policy lets Qubole's AWS account assume it. Every such request must include a matching External ID code supplied by Qubole.
The attacker reached those customers using credentials for an AWS account that Qubole's platform relies on. Wiz's researchers found that most of the roles the attacker assumed were unused, yet each still trusted Qubole's account, so the requests succeeded. AWS accepts such a request when it comes from the trusted account and carries the correct External ID, and AWS's external ID guidance notes that the code is not a secret and can be viewed by anyone with access to the role. How the credentials were obtained has not been disclosed.
What was taken from victim environments
In the accounts the researchers examined, the intruder hunted for stored credentials. It read Lambda environment variables, pulled secrets from Secrets Manager and values from the SSM Parameter Store, then tested the discovered credentials with TruffleHog. They included the victims' own AWS access keys, Entra ID client secrets and Okta client credentials.
The intruder also copied data from S3, retrieving whatever any reachable bucket held and, in some sessions, downloading an entire bucket at once.
A separate campaign using access keys
Qubole also lets customers connect with AWS access keys rather than a role. Between October 8 and October 11, an attacker used customers' own access keys, which the researchers believe had been configured for Qubole, and compromised several victims' cloud environments. The researchers have not tied this activity to the AssumeRole abuse.
They also have not linked the campaign to any other publicly reported activity, and say the choice of targets does not resemble what state-backed groups typically pursue.
What affected organisations should check
Wiz advises any organisation that has connected Qubole to AWS, including those no longer using it, to review CloudTrail logs from October 1 onward. The warning sign is an AssumeRole request from account 805246085872, the account Qubole's platform uses, arriving from an address outside AWS.
The Hacker News, which relayed the report, did not say whether the credentials have since been disabled or the activity has stopped. When it checked, neither Qubole nor Idera had posted a statement about the attack.
Open questions
- How did the attacker obtain the credentials for the Qubole-linked AWS account?
- Have the compromised credentials been disabled, and has the activity stopped?