Covered by 2 outlets — first reported by Wiz Blog, Nov 9, 14:56 UTC
Trusted by Default: Qubole Cross-Account Access Abused in the Wild
MentionsAmazon Web Services
Summary
Wiz says an attacker used credentials for an AWS account that data lake platform Qubole uses to reach its customers to assume integration roles in customer AWS environments. The Hacker News reports that the attacker broke into accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data. How the attacker obtained the credentials has not been disclosed.
AI summary by the SecurityTabs newsroom, checked against Wiz Blog, The Hacker News. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
Wiz BlogFirst report
Trusted by Default: Qubole Cross-Account Access Abused in the Wild
A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it.
The Hacker News
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.
Explained
The technology and terms in this story. Learn more